Edit tour

Linux Analysis Report
0wG3Y7nLHa.elf

Overview

General Information

Sample name:	0wG3Y7nLHa.elf renamed because original name is a hash value
Original sample name:	37011bc117aeefdd95a21340b307c6c3.elf
Analysis ID:	1528332
MD5:	37011bc117aeefdd95a21340b307c6c3
SHA1:	ba3e3de95acc8cb1df691e253a602578a2d16dda
SHA256:	fbdac2d501e594da8a50deb6b1120e92fac6ef477993a107b7d4b2740ae3e620
Tags:	32armelfmirai
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528332
Start date and time:	2024-10-07 19:32:42 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	0wG3Y7nLHa.elf renamed because original name is a hash value
Original Sample Name:	37011bc117aeefdd95a21340b307c6c3.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/101@2/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: 0wG3Y7nLHa.elf

Process Tree

system is lnxubuntu20

0wG3Y7nLHa.elf (PID: 5486, Parent: 5410, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/0wG3Y7nLHa.elf

0wG3Y7nLHa.elf New Fork (PID: 5488, Parent: 5486)

0wG3Y7nLHa.elf New Fork (PID: 5489, Parent: 5486)

0wG3Y7nLHa.elf New Fork (PID: 5492, Parent: 5486)

0wG3Y7nLHa.elf New Fork (PID: 5494, Parent: 5492)

0wG3Y7nLHa.elf New Fork (PID: 5496, Parent: 5492)

0wG3Y7nLHa.elf New Fork (PID: 5497, Parent: 5492)

0wG3Y7nLHa.elf New Fork (PID: 5500, Parent: 5492)

0wG3Y7nLHa.elf New Fork (PID: 5501, Parent: 5492)

gdm3 New Fork (PID: 5538, Parent: 1289)

Default (PID: 5538, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5539, Parent: 1)

dbus-daemon (PID: 5539, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5540, Parent: 1)

rsyslogd (PID: 5540, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5541, Parent: 2955)

pulseaudio (PID: 5541, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gdm3 New Fork (PID: 5542, Parent: 1289)

Default (PID: 5542, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5543, Parent: 1289)

Default (PID: 5543, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gvfsd-fuse New Fork (PID: 5544, Parent: 3147)

fusermount (PID: 5544, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5553, Parent: 1)

rtkit-daemon (PID: 5553, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5556, Parent: 1)

systemd-logind (PID: 5556, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5617, Parent: 1)

polkitd (PID: 5617, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5618, Parent: 1)

gpu-manager (PID: 5618, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5622, Parent: 5618)

sh (PID: 5622, Parent: 5618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5623, Parent: 5622)

grep (PID: 5623, Parent: 5622, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5625, Parent: 5618)

sh (PID: 5625, Parent: 5618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5626, Parent: 5625)

grep (PID: 5626, Parent: 5625, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5627, Parent: 5618)

sh (PID: 5627, Parent: 5618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5628, Parent: 5627)

grep (PID: 5628, Parent: 5627, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5629, Parent: 5618)

sh (PID: 5629, Parent: 5618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5630, Parent: 5629)

grep (PID: 5630, Parent: 5629, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5631, Parent: 5618)

sh (PID: 5631, Parent: 5618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5632, Parent: 5631)

grep (PID: 5632, Parent: 5631, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5633, Parent: 5618)

sh (PID: 5633, Parent: 5618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5634, Parent: 5633)

grep (PID: 5634, Parent: 5633, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5635, Parent: 5618)

sh (PID: 5635, Parent: 5618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5636, Parent: 5635)

grep (PID: 5636, Parent: 5635, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5637, Parent: 5618)

sh (PID: 5637, Parent: 5618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5638, Parent: 5637)

grep (PID: 5638, Parent: 5637, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5624, Parent: 1)

agetty (PID: 5624, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5641, Parent: 1)

generate-config (PID: 5641, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5642, Parent: 5641)

pkill (PID: 5642, Parent: 5641, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5645, Parent: 1)

gdm-wait-for-drm (PID: 5645, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5650, Parent: 1)

gdm3 (PID: 5650, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5654, Parent: 5650)

plymouth (PID: 5654, Parent: 5650, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5672, Parent: 5650)

gdm-session-worker (PID: 5672, Parent: 5650, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5678, Parent: 5672)

gdm-wayland-session (PID: 5678, Parent: 5672, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5682, Parent: 5678)

dbus-run-session (PID: 5682, Parent: 5678, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5683, Parent: 5682)

dbus-daemon (PID: 5683, Parent: 5682, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5687, Parent: 5683)

dbus-daemon New Fork (PID: 5688, Parent: 5687)

false (PID: 5688, Parent: 5687, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5690, Parent: 5683)

dbus-daemon New Fork (PID: 5691, Parent: 5690)

false (PID: 5691, Parent: 5690, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5692, Parent: 5683)

dbus-daemon New Fork (PID: 5693, Parent: 5692)

false (PID: 5693, Parent: 5692, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5694, Parent: 5683)

dbus-daemon New Fork (PID: 5695, Parent: 5694)

false (PID: 5695, Parent: 5694, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5696, Parent: 5683)

dbus-daemon New Fork (PID: 5697, Parent: 5696)

false (PID: 5697, Parent: 5696, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5698, Parent: 5683)

dbus-daemon New Fork (PID: 5699, Parent: 5698)

false (PID: 5699, Parent: 5698, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5703, Parent: 5683)

dbus-daemon New Fork (PID: 5704, Parent: 5703)

false (PID: 5704, Parent: 5703, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5684, Parent: 5682)

gnome-session (PID: 5684, Parent: 5682, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5684, Parent: 5682, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5705, Parent: 5684)

session-migration (PID: 5705, Parent: 5684, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5706, Parent: 5684)

sh (PID: 5706, Parent: 5684, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5706, Parent: 5684, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5733, Parent: 5650)

gdm-session-worker (PID: 5733, Parent: 5650, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5743, Parent: 5733)

gdm-x-session (PID: 5743, Parent: 5733, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5749, Parent: 5743)

Xorg (PID: 5749, Parent: 5743, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5749, Parent: 5743, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5749, Parent: 5743, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5760, Parent: 5749)

sh (PID: 5760, Parent: 5749, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5761, Parent: 5760)

xkbcomp (PID: 5761, Parent: 5760, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6009, Parent: 5749)

sh (PID: 6009, Parent: 5749, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6010, Parent: 6009)

xkbcomp (PID: 6010, Parent: 6009, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5768, Parent: 5743)

Default (PID: 5768, Parent: 5743, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5769, Parent: 5743)

dbus-run-session (PID: 5769, Parent: 5743, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5770, Parent: 5769)

dbus-daemon (PID: 5770, Parent: 5769, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5784, Parent: 5770)

dbus-daemon New Fork (PID: 5785, Parent: 5784)

at-spi-bus-launcher (PID: 5785, Parent: 5784, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5790, Parent: 5785)

dbus-daemon (PID: 5790, Parent: 5785, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6180, Parent: 5790)

dbus-daemon New Fork (PID: 6181, Parent: 6180)

at-spi2-registryd (PID: 6181, Parent: 6180, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5814, Parent: 5770)

dbus-daemon New Fork (PID: 5815, Parent: 5814)

false (PID: 5815, Parent: 5814, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5817, Parent: 5770)

dbus-daemon New Fork (PID: 5818, Parent: 5817)

false (PID: 5818, Parent: 5817, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5819, Parent: 5770)

dbus-daemon New Fork (PID: 5820, Parent: 5819)

false (PID: 5820, Parent: 5819, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5821, Parent: 5770)

dbus-daemon New Fork (PID: 5822, Parent: 5821)

false (PID: 5822, Parent: 5821, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5823, Parent: 5770)

dbus-daemon New Fork (PID: 5824, Parent: 5823)

false (PID: 5824, Parent: 5823, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5825, Parent: 5770)

dbus-daemon New Fork (PID: 5826, Parent: 5825)

false (PID: 5826, Parent: 5825, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5828, Parent: 5770)

dbus-daemon New Fork (PID: 5829, Parent: 5828)

false (PID: 5829, Parent: 5828, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6007, Parent: 5770)

dbus-daemon New Fork (PID: 6008, Parent: 6007)

ibus-portal (PID: 6008, Parent: 6007, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6198, Parent: 5770)

dbus-daemon New Fork (PID: 6199, Parent: 6198)

gjs (PID: 6199, Parent: 6198, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6263, Parent: 5770)

dbus-daemon New Fork (PID: 6264, Parent: 6263)

false (PID: 6264, Parent: 6263, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5771, Parent: 5769)

gnome-session (PID: 5771, Parent: 5769, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5771, Parent: 5769, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5772, Parent: 5771)

gnome-session-check-accelerated (PID: 5772, Parent: 5771, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5791, Parent: 5772)

gnome-session-check-accelerated-gl-helper (PID: 5791, Parent: 5772, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5801, Parent: 5772)

gnome-session-check-accelerated-gles-helper (PID: 5801, Parent: 5772, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5830, Parent: 5771)

session-migration (PID: 5830, Parent: 5771, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5831, Parent: 5771)

sh (PID: 5831, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5831, Parent: 5771, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5994, Parent: 5831)

ibus-daemon (PID: 5994, Parent: 5831, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6003, Parent: 5994)

ibus-memconf (PID: 6003, Parent: 5994, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6005, Parent: 5994)

ibus-daemon New Fork (PID: 6006, Parent: 6005)

ibus-x11 (PID: 6006, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6232, Parent: 5994)

ibus-engine-simple (PID: 6232, Parent: 5994, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6219, Parent: 5771)

sh (PID: 6219, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6219, Parent: 5771, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6221, Parent: 5771)

sh (PID: 6221, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6221, Parent: 5771, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6223, Parent: 5771)

sh (PID: 6223, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6223, Parent: 5771, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6224, Parent: 5771)

sh (PID: 6224, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6224, Parent: 5771, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6225, Parent: 5771)

sh (PID: 6225, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6225, Parent: 5771, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6271, Parent: 6225)

gsd-print-notifications New Fork (PID: 6272, Parent: 6271)

gsd-printer (PID: 6272, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6226, Parent: 5771)

sh (PID: 6226, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6226, Parent: 5771, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6228, Parent: 5771)

sh (PID: 6228, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6228, Parent: 5771, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6231, Parent: 5771)

sh (PID: 6231, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6231, Parent: 5771, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6235, Parent: 5771)

sh (PID: 6235, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6235, Parent: 5771, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6238, Parent: 5771)

sh (PID: 6238, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6238, Parent: 5771, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6239, Parent: 5771)

sh (PID: 6239, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6239, Parent: 5771, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6241, Parent: 5771)

sh (PID: 6241, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6241, Parent: 5771, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6243, Parent: 5771)

sh (PID: 6243, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6243, Parent: 5771, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6247, Parent: 5771)

sh (PID: 6247, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6247, Parent: 5771, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6667, Parent: 5771)

sh (PID: 6667, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6667, Parent: 5771, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6705, Parent: 5771)

sh (PID: 6705, Parent: 5771, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6705, Parent: 5771, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5734, Parent: 5650)

Default (PID: 5734, Parent: 5650, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5735, Parent: 5650)

Default (PID: 5735, Parent: 5650, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5656, Parent: 1)

accounts-daemon (PID: 5656, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5667, Parent: 5656)

language-validate (PID: 5667, Parent: 5656, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5668, Parent: 5667)

language-options (PID: 5668, Parent: 5667, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5669, Parent: 5668)

sh (PID: 5669, Parent: 5668, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5670, Parent: 5669)

locale (PID: 5670, Parent: 5669, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5671, Parent: 5669)

grep (PID: 5671, Parent: 5669, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5680, Parent: 1299)

dbus-daemon (PID: 5680, Parent: 1299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5855, Parent: 1)

systemd-localed (PID: 5855, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6016, Parent: 1)

upowerd (PID: 6016, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6067, Parent: 1299)

pulseaudio (PID: 6067, Parent: 1299, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6072, Parent: 2955)

dbus-daemon (PID: 6072, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6073, Parent: 1)

geoclue (PID: 6073, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6188, Parent: 1)

wpa_supplicant (PID: 6188, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6190, Parent: 1)

avahi-daemon (PID: 6190, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6194, Parent: 6190)

systemd New Fork (PID: 6193, Parent: 2955)

pulseaudio (PID: 6193, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6196, Parent: 1)

packagekitd (PID: 6196, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6214, Parent: 6196)

dpkg (PID: 6214, Parent: 6196, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6274, Parent: 1)

systemd-hostnamed (PID: 6274, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6451, Parent: 1)

ModemManager (PID: 6451, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6511, Parent: 1)

colord (PID: 6511, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6677, Parent: 6511)

colord-sane (PID: 6677, Parent: 6511, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6524, Parent: 1)

systemd-localed (PID: 6524, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6678, Parent: 1)

fprintd (PID: 6678, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
0wG3Y7nLHa.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
0wG3Y7nLHa.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5492.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5492.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5489.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5489.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5494.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5494.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5496.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5496.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5486.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5486.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5488.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5488.1.00007fe060017000.00007fe060028000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5486	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5486	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5488	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5488	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5489	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5489	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5492	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5492	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5494	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5494	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5496	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: 0wG3Y7nLHa.elf PID: 5496	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 19 entries

String: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspctelnetbotdvrHelperbyte-mirai.kro.kr68.183.18.151

Source: global traffic

TCP traffic: 192.168.2.14:42130 -> 154.216.20.119:7777

Source: /usr/sbin/rsyslogd (PID: 5540)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5650)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5683)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5684)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5749)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5770)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5790)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5771)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5994)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 180.50.98.199
Source: unknown	TCP traffic detected without corresponding DNS query: 101.131.124.196
Source: unknown	TCP traffic detected without corresponding DNS query: 168.245.37.199
Source: unknown	TCP traffic detected without corresponding DNS query: 98.25.238.25
Source: unknown	TCP traffic detected without corresponding DNS query: 124.155.57.162
Source: unknown	TCP traffic detected without corresponding DNS query: 211.250.80.115
Source: unknown	TCP traffic detected without corresponding DNS query: 184.164.166.62
Source: unknown	TCP traffic detected without corresponding DNS query: 73.103.239.117
Source: unknown	TCP traffic detected without corresponding DNS query: 200.137.22.187
Source: unknown	TCP traffic detected without corresponding DNS query: 89.244.245.136
Source: unknown	TCP traffic detected without corresponding DNS query: 123.161.156.73
Source: unknown	TCP traffic detected without corresponding DNS query: 106.92.113.196
Source: unknown	TCP traffic detected without corresponding DNS query: 42.19.137.29
Source: unknown	TCP traffic detected without corresponding DNS query: 78.11.109.183
Source: unknown	TCP traffic detected without corresponding DNS query: 61.96.46.251
Source: unknown	TCP traffic detected without corresponding DNS query: 81.118.171.2
Source: unknown	TCP traffic detected without corresponding DNS query: 142.9.137.61
Source: unknown	TCP traffic detected without corresponding DNS query: 176.31.98.125
Source: unknown	TCP traffic detected without corresponding DNS query: 188.244.161.71
Source: unknown	TCP traffic detected without corresponding DNS query: 136.211.113.183
Source: unknown	TCP traffic detected without corresponding DNS query: 97.59.72.228
Source: unknown	TCP traffic detected without corresponding DNS query: 160.38.117.186
Source: unknown	TCP traffic detected without corresponding DNS query: 53.155.117.126
Source: unknown	TCP traffic detected without corresponding DNS query: 111.78.196.12
Source: unknown	TCP traffic detected without corresponding DNS query: 129.33.109.206
Source: unknown	TCP traffic detected without corresponding DNS query: 162.192.193.232
Source: unknown	TCP traffic detected without corresponding DNS query: 196.90.255.152
Source: unknown	TCP traffic detected without corresponding DNS query: 175.180.198.204
Source: unknown	TCP traffic detected without corresponding DNS query: 27.215.195.64
Source: unknown	TCP traffic detected without corresponding DNS query: 181.142.181.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.27.15.180
Source: unknown	TCP traffic detected without corresponding DNS query: 175.186.37.103
Source: unknown	TCP traffic detected without corresponding DNS query: 43.126.34.226
Source: unknown	TCP traffic detected without corresponding DNS query: 91.33.43.171
Source: unknown	TCP traffic detected without corresponding DNS query: 146.109.113.121
Source: unknown	TCP traffic detected without corresponding DNS query: 4.207.144.58
Source: unknown	TCP traffic detected without corresponding DNS query: 153.9.182.111
Source: unknown	TCP traffic detected without corresponding DNS query: 182.220.113.212
Source: unknown	TCP traffic detected without corresponding DNS query: 90.67.113.131
Source: unknown	TCP traffic detected without corresponding DNS query: 111.58.169.84
Source: unknown	TCP traffic detected without corresponding DNS query: 133.186.16.178
Source: unknown	TCP traffic detected without corresponding DNS query: 81.114.194.120
Source: unknown	TCP traffic detected without corresponding DNS query: 67.85.97.161
Source: unknown	TCP traffic detected without corresponding DNS query: 46.47.185.229
Source: unknown	TCP traffic detected without corresponding DNS query: 150.3.164.19
Source: unknown	TCP traffic detected without corresponding DNS query: 155.163.101.212
Source: unknown	TCP traffic detected without corresponding DNS query: 158.185.191.44
Source: unknown	TCP traffic detected without corresponding DNS query: 90.192.24.100
Source: unknown	TCP traffic detected without corresponding DNS query: 197.79.135.220
Source: unknown	TCP traffic detected without corresponding DNS query: 190.251.234.190

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: Xorg.0.log.149.dr, syslog.28.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.149.dr, syslog.28.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.28.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 135, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 277, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 279, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 280, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 282, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 283, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 284, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 285, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 287, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 288, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 290, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 292, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 294, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 295, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 296, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 297, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 300, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 301, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 302, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 305, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 348, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 661, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 671, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 683, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 684, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 725, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 740, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 791, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 940, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent to PID below 1000: pid: 941, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 135, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 277, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 279, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 280, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 282, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 283, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 284, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 285, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 287, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 288, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 290, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 292, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 294, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 295, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 296, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 297, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 300, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 301, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 302, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 305, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 348, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 661, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 671, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 683, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 684, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 725, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 740, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 940, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent to PID below 1000: pid: 941, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1583, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3398, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3412, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3425, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3758, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3759, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 5470, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 5488, result: unknown	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3398, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3412, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3425, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3758, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3759, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 5492, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 5494, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5770)	SIGKILL sent: pid: 5784, result: successful
Source: /usr/bin/dbus-daemon (PID: 5770)	SIGKILL sent: pid: 6007, result: successful
Source: /usr/bin/dbus-daemon (PID: 5770)	SIGKILL sent: pid: 6198, result: successful
Source: /usr/bin/dbus-daemon (PID: 5790)	SIGKILL sent: pid: 6180, result: successful

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspctelnetbotdvrHelperbyte-mirai.kro.kr68.183.18.151

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1583, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3398, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3412, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3425, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3758, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3759, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 5470, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5488)	SIGKILL sent: pid: 5488, result: unknown	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3120, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3125, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3142, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3245, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3329, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3398, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3412, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3425, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3758, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3759, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 5492, result: successful	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	SIGKILL sent: pid: 5494, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5770)	SIGKILL sent: pid: 5784, result: successful
Source: /usr/bin/dbus-daemon (PID: 5770)	SIGKILL sent: pid: 6007, result: successful
Source: /usr/bin/dbus-daemon (PID: 5770)	SIGKILL sent: pid: 6198, result: successful
Source: /usr/bin/dbus-daemon (PID: 5790)	SIGKILL sent: pid: 6180, result: successful

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/101@2/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5539)	File: /proc/5539/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5544)	File: /proc/5544/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5683)	File: /proc/5683/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5770)	File: /proc/5770/mounts
Source: /usr/bin/dbus-daemon (PID: 5790)	File: /proc/5790/mounts
Source: /usr/bin/gjs (PID: 6199)	File: /proc/6199/mounts
Source: /usr/bin/gnome-shell (PID: 5831)	File: /proc/5831/mounts
Source: /usr/bin/dbus-daemon (PID: 5680)	File: /proc/5680/mounts
Source: /usr/bin/dbus-daemon (PID: 6072)	File: /proc/6072/mounts

Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/seats/.#seat00J7hqj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127lqzANl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127a6R6zk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c1kPhuNk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127lmHoxj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/seats/.#seat052hiwj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127ZjGqYj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c1inChSj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c1l1Oo8i	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127TGqIMk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/seats/.#seat0lr1BSl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c1cbs2ej	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127B6Mv1l	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c1SSrN1i	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c1uY3hbl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c1CUgKdi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127SPRW1i	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/seats/.#seat0fOaf9h	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127JnvAek	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/seats/.#seat0LPZ9Wj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127usWfsj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/seats/.#seat0NiKq5k	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127F9Aebj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c2NgnE3j	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#127T7vfdi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/seats/.#seat0n0aptk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c2XO1ZYl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c2SMhRDh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/users/.#1276pOcrj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c2c4TRDj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c25ZlVXi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c2ulIOXl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c2YHvsQl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/sessions/.#c2cDnHHh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/inhibit/.#1UMWL7i	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/inhibit/.#2DgL7Pl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/inhibit/.#3961hkj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/inhibit/.#4wMaZ0h	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5556)	File: /run/systemd/inhibit/.#5jiKWMj	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5617)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5706)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5706)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5749)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5749)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5772)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5772)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5772)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5791)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5801)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5801)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5801)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5831)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5831)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5831)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5831)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5831)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5831)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5831)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6006)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6006)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6221)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6221)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6223)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6223)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6224)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6224)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6226)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6226)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6247)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6247)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5656)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5656)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6016)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6016)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6196)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6274)	Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6451)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6451)	Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6511)	Directory: /var/lib/colord/.cache

Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/5790/status
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/5790/attr/current
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/6221/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/6223/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/5772/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/6247/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/6224/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/6235/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/6181/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/5831/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/6006/cmdline
Source: /usr/bin/dbus-daemon (PID: 5790)	File opened: /proc/5801/cmdline
Source: /usr/bin/dbus-daemon (PID: 5680)	File opened: /proc/5680/status
Source: /usr/bin/dbus-daemon (PID: 5680)	File opened: /proc/5680/attr/current
Source: /usr/bin/dbus-daemon (PID: 5680)	File opened: /proc/6067/cmdline
Source: /usr/bin/dbus-daemon (PID: 5680)	File opened: /proc/1299/cmdline
Source: /usr/bin/dbus-daemon (PID: 5680)	File opened: /proc/5743/cmdline
Source: /usr/bin/dbus-daemon (PID: 5680)	File opened: /proc/5678/cmdline
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/0wG3Y7nLHa.elf (PID: 5494)	File opened: /proc/259/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5622)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5625)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5627)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5629)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5631)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5635)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5637)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5760)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6009)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5669)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5623)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5626)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5628)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5630)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5632)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5634)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5636)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5638)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5671)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5642)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5624)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5650)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5650)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5656)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5656)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5540)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5540)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5618)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5749)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5618)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5749)	Truncated file: /var/log/Xorg.pid-5749.log

Source: /usr/bin/pulseaudio (PID: 5541)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5642)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5749)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5791)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5801)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5831)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6067)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6193)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/0wG3Y7nLHa.elf (PID: 5486)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5540)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5541)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5618)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5624)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5672)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5684)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5733)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5743)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5749)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5785)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6181)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5771)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5772)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5791)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5801)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5831)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6006)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6221)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6223)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6224)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6228)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6235)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6247)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6067)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6190)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6193)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6196)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6274)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6677)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6678)	Queries kernel information via 'uname':

Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.960] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.941] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.104] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.603] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.332] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: 0wG3Y7nLHa.elf, 5488.1.00007ffd10354000.00007ffd10375000.rw-.sdmp	Binary or memory string: mU/tmp/qemu-open.mx8Hpch
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.630] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.903] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.576] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.563] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.203] (--) vmware(0): vis: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.636] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.682] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.758] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:12 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.567] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.597] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:12 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.531] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.144] (--) vmware(0): mheig: 885
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.028] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.955] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.136] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.609] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:17 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.777] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.673] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.716] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.674] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.853] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.181] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.616] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.207] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.322] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.294] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.899] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.027] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.464] (==) Matched vmware as autoconfigured driver 0
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.499] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.063] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:16 galassia /usr/lib/gdm3/gdm-x-session[5749]: (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.074] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.408] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.751] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.228] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.214] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:17 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.757] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:13 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.106] (--) vmware(0): bpp: 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.337] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:17 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.162] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.280] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.283] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.811] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.168] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.091] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.225] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.430] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.305] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.455] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.539] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.755] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.095] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.697] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.867] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.040] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.582] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): vis: 4
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.234] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.370] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.348] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.749] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.922] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.662] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.576] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.234] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.765] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.020] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.999] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.323] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.764] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.919] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:16 galassia /usr/lib/gdm3/gdm-x-session[5749]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.435] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.508] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.328] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.982] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.190] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.708] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.717] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.560] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.535] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.362] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.351] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.732] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.839] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.966] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.572] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.531] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.644] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.669] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:16 galassia /usr/lib/gdm3/gdm-x-session[5749]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.732] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.413] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.046] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.463] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 164.995] (EE) vmware(0): Failed to open drm.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.314] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.474] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:30 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.202] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.116] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.154] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.323] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.141] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.623] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.133] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.211] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.475] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.705] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.992] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.056] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.730] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.686] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:17 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.775] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.493] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.888] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.408] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.948] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.219] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.094] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.170] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: 0wG3Y7nLHa.elf, 5494.1.00007ffd10354000.00007ffd10375000.rw-.sdmp	Binary or memory string: mU/tmp/qemu-open.Lx3zZDh
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.694] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.662] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.884] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.704] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:12 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.415] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.740] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.516] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.314] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.147] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.014] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.272] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.917] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.669] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.594] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.459] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.400] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.581] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.054] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.785] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:12 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.592] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:17 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.636] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.813] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.409] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.661] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.342] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.806] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.994] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.748] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:30 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: 0wG3Y7nLHa.elf, 5486.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5488.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5489.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5492.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5494.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5496.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp	Binary or memory string: mU!/etc/qemu-binfmt/arm
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.714] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.720] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.124] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.615] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.421] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.874] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.502] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: 0wG3Y7nLHa.elf, 5488.1.00007ffd10354000.00007ffd10375000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.mx8Hpc
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.077] (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): Using HW cursor
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:17 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.133] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.425] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.218] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.179] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.792] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.127] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.671] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.725] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.520] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.632] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.160] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.198] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.616] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.222] (==) vmware(0): RGB weight 888
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.489] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.462] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.681] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.376] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.899] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.553] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.009] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.346] (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.026] (WW) vmware(0): Disabling 3D support.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): RGB weight 888
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.401] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.364] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.071] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.605] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.222] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.253] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.230] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: 0wG3Y7nLHa.elf, 5486.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5488.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5489.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5492.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5494.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5496.1.00007ffd10354000.00007ffd10375000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.007] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.298] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.318] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.481] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.044] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.476] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.664] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.552] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.353] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.862] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:12 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) LoadModule: "vmware"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.721] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.772] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.256] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.333] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.797] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.127] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.996] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.230] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.944] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.974] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.260] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.797] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.241] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.396] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.055] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.447] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.703] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.893] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.115] (--) vmware(0): vram: 4194304
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.606] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.193] (--) vmware(0): w.blu: 8
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.529] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.981] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.583] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.814] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.295] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.653] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.650] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.115] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): w.grn: 8
Source: 0wG3Y7nLHa.elf, 5486.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5488.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5489.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5492.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5494.1.00007ffd10354000.00007ffd10375000.rw-.sdmp, 0wG3Y7nLHa.elf, 5496.1.00007ffd10354000.00007ffd10375000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/0wG3Y7nLHa.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/0wG3Y7nLHa.elf
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.777] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.357] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.394] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.741] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.939] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.881] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.381] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.742] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.195] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:30 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.547] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.683] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.540] (II) LoadModule: "vmware"
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.166] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.437] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.186] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.199] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.845] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.427] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.509] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.235] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.309] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.637] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.711] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.177] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.470] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.560] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.716] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.421] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.151] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.733] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.754] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.715] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.265] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.839] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.962] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:17 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:17 galassia /usr/lib/gdm3/gdm-x-session[5749]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.860] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.390] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.272] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.093] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.682] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.371] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.697] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.056] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:16 galassia /usr/lib/gdm3/gdm-x-session[5749]: (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.784] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.249] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.133] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:30 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:22 galassia /usr/lib/gdm3/gdm-x-session[5749]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.380] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.822] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.083] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.373] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:19 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.301] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.789] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.832] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.067] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.092] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.087] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:20 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:21 galassia /usr/lib/gdm3/gdm-x-session[5749]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.163] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:18 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.602] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.170] (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.824] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.448] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.333] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:29 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.170] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: 0wG3Y7nLHa.elf, 5494.1.00007ffd10354000.00007ffd10375000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.Lx3zZD
Source: 0wG3Y7nLHa.elf, 5486.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5488.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5489.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5492.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5494.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp, 0wG3Y7nLHa.elf, 5496.1.0000556df2dcf000.0000556df2efd000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.496] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 168.121] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.124] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:34:28 galassia /usr/lib/gdm3/gdm-x-session[5749]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.149] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 167.511] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 166.675] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5656)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 0wG3Y7nLHa.elf, type: SAMPLE
Source: Yara match	File source: 5492.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5494.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5496.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5486.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5488.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5486, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5489, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5494, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5496, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: 0wG3Y7nLHa.elf, type: SAMPLE
Source: Yara match	File source: 5492.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5494.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5496.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5486.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5488.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5486, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5489, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5494, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5496, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 0wG3Y7nLHa.elf, type: SAMPLE
Source: Yara match	File source: 5492.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5494.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5496.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5486.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5488.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5486, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5489, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5494, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5496, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: 0wG3Y7nLHa.elf, type: SAMPLE
Source: Yara match	File source: 5492.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5494.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5496.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5486.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5488.1.00007fe060017000.00007fe060028000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5486, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5489, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5494, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wG3Y7nLHa.elf PID: 5496, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0wG3Y7nLHa.elf	58%	ReversingLabs	Linux.Backdoor.Mirai
0wG3Y7nLHa.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.28.dr	false	unknown
http://wiki.x.org	Xorg.0.log.149.dr, syslog.28.dr	false	unknown
http://www.ubuntu.com/support)	Xorg.0.log.149.dr, syslog.28.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
93.13.252.47	unknown	France	15557	LDCOMNETFR	false
47.171.56.51	unknown	United States	5650	FRONTIER-FRTRUS	false
193.82.96.197	unknown	United Kingdom	1290	TELSTRAEUROPELTD-BACKBONETelstraEuropeLtdEU	false
101.130.79.142	unknown	China	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
142.134.43.125	unknown	Canada	855	CANET-ASN-4CA	false
187.145.90.104	unknown	Mexico	8151	UninetSAdeCVMX	false
201.9.72.17	unknown	Brazil	7738	TelemarNorteLesteSABR	false
125.47.143.160	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
108.157.2.207	unknown	United States	16509	AMAZON-02US	false
24.146.89.212	unknown	Canada	7311	FRONTIERCA	false
190.224.109.134	unknown	Argentina	7303	TelecomArgentinaSAAR	false
84.2.93.203	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	false
79.36.116.218	unknown	Italy	3269	ASN-IBSNAZIT	false
113.82.60.104	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
49.52.78.32	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
75.105.189.166	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
219.108.208.72	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
84.90.34.110	unknown	Portugal	13156	AS13156PalmelaPT	false
98.89.244.70	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
122.243.157.232	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
54.22.206.160	unknown	United States	14618	AMAZON-AESUS	false
177.156.12.160	unknown	Brazil	18881	TELEFONICABRASILSABR	false
171.236.23.19	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
40.210.204.191	unknown	United States	4249	LILLY-ASUS	false
135.76.170.61	unknown	United States	18676	AVAYAUS	false
212.206.200.65	unknown	Netherlands	702	UUNETUS	false
47.171.56.44	unknown	United States	5650	FRONTIER-FRTRUS	false
58.62.225.117	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
115.33.63.25	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
98.102.147.247	unknown	United States	10796	TWC-10796-MIDWESTUS	false
54.68.25.189	unknown	United States	16509	AMAZON-02US	false
111.65.234.232	unknown	New Zealand	56030	VOYAGERNET-AS-APVoyagerInternetLtdNZ	false
13.19.25.65	unknown	United States	26662	XEROX-WVUS	false
53.64.1.27	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
184.200.156.122	unknown	United States	10507	SPCSUS	false
194.171.230.97	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
203.101.40.159	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
77.51.110.97	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
46.205.212.153	unknown	Poland	12912	TMPL	false
44.194.145.148	unknown	United States	14618	AMAZON-AESUS	false
1.46.51.99	unknown	Thailand	24378	ENGTAC-AS-TH-APTotalAccessCommunicationPLCTH	false
67.66.186.117	unknown	United States	7018	ATT-INTERNET4US	false
106.28.32.71	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
99.28.65.214	unknown	United States	7018	ATT-INTERNET4US	false
46.8.80.195	unknown	Russian Federation	47193	LAN-OPTICRU	false
95.64.65.99	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
188.136.134.214	unknown	Iran (ISLAMIC Republic Of)	48309	AGS-ASIR	false
78.137.136.48	unknown	Ireland	31122	DIGIWEB-ASIE	false
102.14.85.59	unknown	unknown	37069	MOBINILEG	false
221.140.106.219	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
123.63.40.175	unknown	India	55410	VIL-AS-APVodafoneIdeaLtdIN	false
202.36.196.180	unknown	New Zealand	2497	IIJInternetInitiativeJapanIncJP	false
195.125.64.115	unknown	Germany	702	UUNETUS	false
138.135.243.9	unknown	United States	3269	ASN-IBSNAZIT	false
94.35.125.227	unknown	Italy	8612	TISCALI-IT	false
212.65.164.111	unknown	Switzerland	47194	OBLCOMSW-ASCH	false
207.18.226.52	unknown	United States	701	UUNETUS	false
180.120.186.124	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false
197.191.38.225	unknown	Ghana	37140	zain-asGH	false
27.64.175.253	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
106.211.115.90	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
95.81.253.238	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
90.184.17.152	unknown	Denmark	39554	FULLRATEDK	false
37.205.63.165	unknown	United Kingdom	41811	CONVERGENCE-GROUPGB	false
160.225.206.87	unknown	Angola	11259	ANGOLATELECOMAO	false
140.230.5.34	unknown	Canada	8111	DALUNIVCA	false
72.212.168.212	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
74.73.236.183	unknown	United States	12271	TWC-12271-NYCUS	false
181.240.78.162	unknown	Colombia	26611	COMCELSACO	false
108.195.224.164	unknown	United States	7018	ATT-INTERNET4US	false
172.10.105.125	unknown	United States	7018	ATT-INTERNET4US	false
14.108.23.6	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
19.6.61.249	unknown	United States	3	MIT-GATEWAYSUS	false
110.242.6.192	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
146.118.110.68	unknown	Australia	134111	CSIRO-PAWSEY-AS-APCommonwealthScientificandIndustrialRe	false
122.54.90.199	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
186.210.235.24	unknown	Brazil	53006	ALGARTELECOMSABR	false
78.10.196.214	unknown	Poland	12741	AS-NETIAWarszawa02-822PL	false
165.113.152.71	unknown	United States	4544	CONXION-AUS	false
91.74.48.85	unknown	United Arab Emirates	15802	DU-AS1AE	false
17.12.6.101	unknown	United States	714	APPLE-ENGINEERINGUS	false
190.132.94.236	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
145.33.202.79	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
8.21.158.162	unknown	United States	14283	BLUEONEUS	false
141.192.6.91	unknown	Finland	1342	FujitsuInviaFinlandIP-networkEU	false
20.202.12.154	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
35.157.3.227	unknown	United States	16509	AMAZON-02US	false
86.233.155.63	unknown	France	3215	FranceTelecom-OrangeFR	false
44.102.22.172	unknown	United States	7377	UCSDUS	false
70.167.36.159	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
222.233.97.174	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
85.169.238.242	unknown	France	21502	ASN-NUMERICABLEFR	false
95.137.253.17	unknown	Georgia	34797	SYSTEM-NETGE	false
195.205.31.212	unknown	Poland	5617	TPNETPL	false
17.68.112.162	unknown	United States	714	APPLE-ENGINEERINGUS	false
9.250.167.47	unknown	United States	3356	LEVEL3US	false
123.14.170.221	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
75.9.72.88	unknown	United States	7018	ATT-INTERNET4US	false
116.217.204.91	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
58.71.0.163	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
93.13.252.47	92MeiLms1V	Get hash	malicious	Mirai	Browse
79.36.116.218	mips-20230709-1715.elf	Get hash	malicious	Mirai	Browse
75.105.189.166	sora.arm	Get hash	malicious	Mirai	Browse
	e2tPHVCPvZ	Get hash	malicious	Mirai	Browse
	xlm7kEdsIp	Get hash	malicious	Mirai	Browse
101.130.79.142	V6CBYJwDC5	Get hash	malicious	Mirai	Browse
101.130.79.142	OJ7eL1MnRR	Get hash	malicious	Mirai	Browse
187.145.90.104	sora.arm.elf	Get hash	malicious	Mirai	Browse
187.145.90.104	xu0PL9fBPy.elf	Get hash	malicious	Mirai	Browse
84.90.34.110	boat.arm-20220427-2000	Get hash	malicious	Mirai	Browse
84.90.34.110	frosty.x86	Get hash	malicious	Mirai	Browse
125.47.143.160	Yoshi.arm-20211110-0350	Get hash	malicious	Mirai	Browse
108.157.2.207	LfI5pQnZBu.elf	Get hash	malicious	Mirai	Browse
190.224.109.134	GAX3uBv1T8.elf	Get hash	malicious	Mirai	Browse
190.224.109.134	onE9luF6lN	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-mirai.kro.kr	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LDCOMNETFR	xd.arm7.elf	Get hash	malicious	Mirai	Browse	84.99.238.82
	xd.arm.elf	Get hash	malicious	Mirai	Browse	109.21.194.39
	x86.elf	Get hash	malicious	Mirai	Browse	93.2.49.31
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	79.85.35.8
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	77.198.164.103
	na.elf	Get hash	malicious	Mirai	Browse	62.39.89.41
	na.elf	Get hash	malicious	Mirai	Browse	109.19.122.132
	na.elf	Get hash	malicious	Mirai	Browse	77.133.88.26
	na.elf	Get hash	malicious	Mirai	Browse	77.148.110.168
	z3hir.arm7.elf	Get hash	malicious	Mirai	Browse	84.101.74.24
TELSTRAEUROPELTD-BACKBONETelstraEuropeLtdEU	sora.sh4.elf	Get hash	malicious	Mirai	Browse	195.152.180.146
	firmware.m68k.elf	Get hash	malicious	Unknown	Browse	154.32.86.48
	x86.elf	Get hash	malicious	Unknown	Browse	146.101.71.72
	63HUYW299f.elf	Get hash	malicious	Unknown	Browse	146.101.58.76
	tdQ8dOfnDZ.elf	Get hash	malicious	Mirai, Moobot	Browse	195.153.209.246
	Lt9n9tfJhl.elf	Get hash	malicious	Unknown	Browse	193.82.127.8
	skt.ppc.elf	Get hash	malicious	Mirai	Browse	195.152.180.188
	vZBUQqNWgr.elf	Get hash	malicious	Mirai	Browse	195.152.180.183
	datFGBhnqF.elf	Get hash	malicious	Mirai	Browse	146.101.83.52
	SXfiF4NeaQ.elf	Get hash	malicious	Mirai	Browse	154.8.99.249
CHINATELECOM-CTCLOUDCloudComputingCorporationCN	na.elf	Get hash	malicious	Mirai, Okiru	Browse	36.114.86.34
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	36.114.86.25
	na.elf	Get hash	malicious	Mirai	Browse	182.43.215.232
	yakov.m68k.elf	Get hash	malicious	Mirai	Browse	150.223.203.192
	SecuriteInfo.com.Linux.Siggen.9999.30976.5557.elf	Get hash	malicious	Mirai	Browse	101.215.72.243
	7fi7NmSbkN.elf	Get hash	malicious	Mirai	Browse	36.114.86.58
	jade.x86.elf	Get hash	malicious	Mirai	Browse	101.213.126.31
	mdfh8nJQAy.elf	Get hash	malicious	Mirai, Moobot	Browse	101.217.8.158
	SecuriteInfo.com.Linux.Siggen.9999.8861.1379.elf	Get hash	malicious	Mirai	Browse	101.217.88.65
	file.exe	Get hash	malicious	CobaltStrike	Browse	113.125.25.119
FRONTIER-FRTRUS	x86.elf	Get hash	malicious	Mirai	Browse	104.226.30.56
	xd.x86.elf	Get hash	malicious	Mirai	Browse	192.183.149.25
	na.elf	Get hash	malicious	Mirai	Browse	50.36.136.47
	pur361ECCi.elf	Get hash	malicious	Mirai	Browse	74.43.190.191
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	65.37.101.229
	na.elf	Get hash	malicious	Mirai	Browse	72.64.79.245
	na.elf	Get hash	malicious	Mirai	Browse	47.178.28.170
	na.elf	Get hash	malicious	Mirai	Browse	47.164.8.217
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	71.96.164.138
	na.elf	Get hash	malicious	Mirai	Browse	71.246.52.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5688/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5691/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5693/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5695/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5697/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5699/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5704/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5785/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5815/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5818/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5820/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5822/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5824/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5826/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5829/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6008/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6181/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6199/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6264/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:xF:j
MD5:	CD89F6E69417CC69D1E3E7FDA54603A3
SHA1:	09AD1093283E836407029CEDD16920EA22C76C3D
SHA-256:	D916EAF727A829253B3BC68A52123BA2029F3748A2BFE168432458F6E394D378
SHA-512:	5A25AB96109E729D0B191AFD1EB23400E3C1AA5E440909C0977C9416E6ABBABDF2293E0F3428C75F534FB2D61DFC86D079DB977ACB0F4D4A4C197CB4167FBD14
Malicious:	false
Preview:	6190.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:GKn:GK
MD5:	001E1D4E1AA9AC36B6949E5B4DA2A761
SHA1:	879176A6E21C1DEDB4BECF90D4F21DD37210E46F
SHA-256:	01540BF2961839F4C7788E71A10CE3841ECFC8D3DF84C944BFADF4BDB3F17AC0
SHA-512:	3DB26BEA252D760D71E182BADF34E8FE3E2FDEC84BFA78627673B9F5FC5B74ED2F6599185C0E4B0C0FCE17C343D3CE6CA1272C648F94DA4BBCD3FB4A80AD6AF0
Malicious:	false
Preview:	5650.

/run/systemd/inhibit/.#1UMWL7i

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.081938310953364
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifhYYAIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfXAApLHK7wR9n
MD5:	3C3E63A9C1009333C2CA12BF9E96FBD2
SHA1:	047FFC1F58BCC258551808ABB6F2DAB3BB760E92
SHA-256:	BA3E8C9B13CA9C83C857E88CA4D1EEA4B62A252BA90EA48FEE17EBEB70ADFFDC
SHA-512:	24A9DCBD535A10C2CF15DEB7C9ABA1F3070845ABE4A9995BB414C777610861C5925B4050EFD9AB58434D930D2078F3F2CE1726058288E3180EE7D494892CA14D
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6016.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2DgL7Pl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.215589092263669
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+EqKLXv0Rsz:qgFqXQXTI1IlJqKjcRsz
MD5:	97AC97E194110DC241423252E651A638
SHA1:	DA9C19350C0E96BD8D49C8DA72119155908FEE36
SHA-256:	99811612272F93532EEB22FDEABD2F1D301D4BFA07AFFBAC19756BCE4433124C
SHA-512:	7F618627FD3171B7CF812FE184C5A355BE943537166A6342856FF3115653D91697A9C4C706808F368FF49CA791F4991EE5A7D7986E1E27EF04D1A70852852ADF
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6235.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3961hkj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++HvR3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+EqKLXv0RT
MD5:	B1C269A24A938BC08BEFF642564BEFDD
SHA1:	010B8ABA91030E600CD3202445BB6F3D58DAE1C1
SHA-256:	D8E210E6588330A29260AB4259F46F9539974AEA1670DD88762E69042785C647
SHA-512:	242B23E7726EDAB9C1CAB2F5AB9B3B52134012C72ACB9FAF67B100BDB432F44455C0C94BF0E73CBDF5BB4FBD88BEB7EC14F66F25448C0194B4E0EFF7046653EC
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6235.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4wMaZ0h

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.138883971711133
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++myYYC3iXulpv5RX8/SflY:SbFuFyL8OAAx+OYDlpLRS
MD5:	EFC876835A0A4077898A1F1003A8F380
SHA1:	CEFC67DF73C09F06A73B24381D9E28C96FD650FC
SHA-256:	DF76173DE9101177926C57309CB98F1CCFDA75F53D1A483CF609BCC671789C83
SHA-512:	31344368A00291CF4CCCCD95263AC4D876976120172852A33F286F68849C324210DF721CBBEF2672385B7F5E539E300070A0AB7086A8C389E5860959FA04569B
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6247.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/inhibit/.#5jiKWMj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.974198609053518
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifWqvDkBoDWicRF2Tg+tX8/Sf5:SbFuFyL8OAApfNDjDJcjKR5
MD5:	2AF80444510A2116C06C9BE855B5BBB8
SHA1:	469D4A279B567E3DAF6B64A64E50E9C408C93CE2
SHA-256:	D38454E8C63FEC398F8129C744104EE7933224126D2556F45A3CB71AF69DC81A
SHA-512:	EB32F5AC597386E012CE757E7D18E45CDFB4D6F26447320CCF560A8A036A625DA939B9B23EA87F3F97CB9440F764D4ECB02B78213F573D76A3868AE0840A7129
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6451.WHO=ModemManager.WHY=ModemManager needs to reset devices.FIFO=/run/systemd/inhibit/5.ref.

/run/systemd/seats/.#seat00J7hqj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat052hiwj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0LPZ9Wj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0NiKq5k

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0fOaf9h

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0lr1BSl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0n0aptk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/sessions/.#c1CUgKdi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.407350603940708
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBK8gdD2+zyT:qgFqPuFdDJIi9x2xayWK8gdqzT
MD5:	8ABC3D9B2DD9938BB2F53406ADA85D16
SHA1:	A5ABA2094047D005B53B7E439E25DD1B2895EE06
SHA-256:	397A4B16D37A32B4D19C67543CEB013E8E686442F2D90AA0AF74DB4190A39357
SHA-512:	F3539A858BA5160505F30E19C4BE70B3CC56A26BD4416059910C4DAAFFFA0D7747EF17C5794F06524831406FAE286DD351768E581DC514D466453D49A8AF54D9
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5672.REALTIME=1728322435692075.MONOTONIC=143861994.

/run/systemd/sessions/.#c1SSrN1i

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.457604689209507
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK8gdD2+zyqkH:qgFqPuFN6IG0n99x2xayWK8gdqzb
MD5:	9999D19E6509BDA27FF3020BB24E43F3
SHA1:	9E38DA432639DBD200A9F455842D6D77DAC895BA
SHA-256:	C5AF6DFC72C6908FAF0026BC189F5C3DF5E6C630BBD86831E564A35AD103A727
SHA-512:	C1F8218A60C42319787B3162275AFE4279A131AE24A3EB9220783047C62DE207286A455402EB2DC798D7F51D80B3F7180824E77A01C53706FB9F0D6535CE71BB
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5672.REALTIME=1728322435692075.MONOTONIC=143861994.CONTROLLER=:1.13.

/run/systemd/sessions/.#c1cbs2ej

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.448151111681513
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK8gdD2+zyT:qgFqPuFN6IG0n99x2xayWK8gdqzT
MD5:	B985D4F0EB1F82E5E8B4477BF88747E8
SHA1:	378C0F2986829B346A20AE99781BF67FDBF820DA
SHA-256:	3CCCBC80D662EFEE4F721A941A2C2DE8D448CAAB8A8132A7D2821E02CF23C793
SHA-512:	C2822A0014D80F7226F2370296CB5125B8C6609FE0B2F5B92A31F694389905F14A55AF1A5519401A258C024216A4DA6B2A4371882316D7312702B14C633DA895
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5672.REALTIME=1728322435692075.MONOTONIC=143861994.

/run/systemd/sessions/.#c1inChSj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.449900200300368
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBK8gdD2+zyT:qgFqPumW8IG0n99x2xayWK8gdqzT
MD5:	93AF36A63DD3E5D9B15F51D819B47354
SHA1:	38F9606EC348DF6543EFD83DB483AA47D03703D5
SHA-256:	C496CAC3EEC5416F3BAFF97986CB6C25A516C15CDB7A8BE7C6AD95D49BD499AD
SHA-512:	F75756E06A76736836272CC3B25ECC53398B93E2022F8462BA54A07D010D0399E2E43481810AB1680B55FEA9E87353F0BEA652975453834A16D68F5ED1C62F5A
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5672.REALTIME=1728322435692075.MONOTONIC=143861994.

/run/systemd/sessions/.#c1kPhuNk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.503941280311399
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedVuRmUKBhcIS3xffCuxfx2xNIByy6GBK8gdD2+zyT:qgFqPumVuRZI4B19x2xayWK8gdqzT
MD5:	1749A060DD6AB53A874778C885FED738
SHA1:	71940344EABD081BDFFE7A49F6DE664F8F91F873
SHA-256:	8AC45CC89302D9A44F8E6785FD256DFF6192EEDFB668C4638DB7D306D3C3ADC8
SHA-512:	B2850E4DC3AD29C865FE7A3AA0D06F8869197F184D8D5C64E65BB1F4055DC5DC36D9AB0D71654FC0FF26D6C3B097416F8C63FAF54C8E985FE3EF8E55CC5753F4
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7811.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5672.REALTIME=1728322435692075.MONOTONIC=143861994.

/run/systemd/sessions/.#c1l1Oo8i

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.449900200300368
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBK8gdD2+zyT:qgFqPumW8IG0n99x2xayWK8gdqzT
MD5:	93AF36A63DD3E5D9B15F51D819B47354
SHA1:	38F9606EC348DF6543EFD83DB483AA47D03703D5
SHA-256:	C496CAC3EEC5416F3BAFF97986CB6C25A516C15CDB7A8BE7C6AD95D49BD499AD
SHA-512:	F75756E06A76736836272CC3B25ECC53398B93E2022F8462BA54A07D010D0399E2E43481810AB1680B55FEA9E87353F0BEA652975453834A16D68F5ED1C62F5A
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5672.REALTIME=1728322435692075.MONOTONIC=143861994.

/run/systemd/sessions/.#c1uY3hbl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.448151111681513
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK8gdD2+zyT:qgFqPuFN6IG0n99x2xayWK8gdqzT
MD5:	B985D4F0EB1F82E5E8B4477BF88747E8
SHA1:	378C0F2986829B346A20AE99781BF67FDBF820DA
SHA-256:	3CCCBC80D662EFEE4F721A941A2C2DE8D448CAAB8A8132A7D2821E02CF23C793
SHA-512:	C2822A0014D80F7226F2370296CB5125B8C6609FE0B2F5B92A31F694389905F14A55AF1A5519401A258C024216A4DA6B2A4371882316D7312702B14C633DA895
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5672.REALTIME=1728322435692075.MONOTONIC=143861994.

/run/systemd/sessions/.#c25ZlVXi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.43755324727797
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB1vrgdwoTl:qgFqPuFNuCH0nI9x2xayW1vrgdw6l
MD5:	BFE9640CEF6AB0584B7FA2C8352BC913
SHA1:	0D36C01A5FDCA5FBA20D82317026DD68A2F926A9
SHA-256:	7650F0B306F0F32E3149F2650147F52C88355DA9F95774A64901AE14B7C8CD29
SHA-512:	4D4B1EBA438674493B0F9722527E78B8E26F3AFD3AC5F078D90331F11B6B20DBF5D711F905BD2FDB630A0523C8C7604664EEAEA70BE51ECFC3B1C500B88581F3
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5733.REALTIME=1728322447558921.MONOTONIC=155728840.CONTROLLER=:1.17.DEVICES=13:64 .

/run/systemd/sessions/.#c2NgnE3j

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.46880806960854
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffC3xfx2xNIByy6GB1vrgdwoL:qgFqPuFVuRpCvBM9x2xayW1vrgdwo
MD5:	E1DADEEEAE01B1796927D914F7B1EC4A
SHA1:	CBF07CE811FC206945119E5FF6687DB952207197
SHA-256:	CAB406A5DD909E2F7B6B3FC16B592D93EEE07C0DFC2255D093ED1B93987444C1
SHA-512:	0A610071EF050CED8BD82896BCC2A24B9A6972DB105C742657F0BF8EADC619A7EE40A346EEF3CF793FD30A2EC9D8AA4B3965544AFACEEA3F7EED5F1A98E42D9B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7874.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5733.REALTIME=1728322447558921.MONOTONIC=155728840.

/run/systemd/sessions/.#c2SMhRDh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.414777301382012
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB1vrgdwoL:qgFqPuFNuCH0nI9x2xayW1vrgdwo
MD5:	421B4576105D7EBEE5A108A586D3ED14
SHA1:	F4B94CC853FFA48B7B3323E0EAB561EAF23C8279
SHA-256:	56F244243F4A1CE3A10757437E8D2F9F7ED1572D1F07D4220BE550BB12F93409
SHA-512:	AF54288C23BF1EF256AFE012931B1B2077B458B97E28A8A4CBF636B48D9C3F8F5E4578B9F82C931880234FC088D4B9C8BC38A9B4B9F3E754A6D0AF56E340F521
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5733.REALTIME=1728322447558921.MONOTONIC=155728840.

/run/systemd/sessions/.#c2XO1ZYl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.414777301382012
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB1vrgdwoL:qgFqPuFNuCH0nI9x2xayW1vrgdwo
MD5:	421B4576105D7EBEE5A108A586D3ED14
SHA1:	F4B94CC853FFA48B7B3323E0EAB561EAF23C8279
SHA-256:	56F244243F4A1CE3A10757437E8D2F9F7ED1572D1F07D4220BE550BB12F93409
SHA-512:	AF54288C23BF1EF256AFE012931B1B2077B458B97E28A8A4CBF636B48D9C3F8F5E4578B9F82C931880234FC088D4B9C8BC38A9B4B9F3E754A6D0AF56E340F521
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5733.REALTIME=1728322447558921.MONOTONIC=155728840.

/run/systemd/sessions/.#c2YHvsQl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.458876099793592
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB1vrgdwoTmk:qgFqPuFNuCH0nI9x2xayW1vrgdw6mk
MD5:	3749F5DA9C602824C0D5041794E31FD2
SHA1:	7C625EFEFC37ADE7B16B6B257BEF9327FD14B8B9
SHA-256:	F4B93210BDD7CE64EB0046197B53CC3955F4A779D89ACD52403EC39748132333
SHA-512:	A66DE0138D2AD87343651AF1C4DCDC082473B5426F22248CDEE9D89BBE11320A0ED5F8F1F8B2077B032F6647B1F2A5564CF45BA04B3285BE40647D6D7B3C9695
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5733.REALTIME=1728322447558921.MONOTONIC=155728840.CONTROLLER=:1.17.DEVICES=13:65 13:67 13:64 .

/run/systemd/sessions/.#c2c4TRDj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.423184543844649
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB1vrgdwoT7:qgFqPuFNuCH0nI9x2xayW1vrgdw67
MD5:	04D3DF4313530A138EBD9A03CD48A6E3
SHA1:	771DC7624B4417DCBF29070FA348E7F28080B35E
SHA-256:	EA835E25A9BAFBDBA6D30081AC7FCA1FE098EE124BD46E7E43821033A67409B1
SHA-512:	A84BCF169BF39DA2BE26500D79AA04C4163C7D229CEC96E4BC203B7D9FD99DBD96E7AAB143D5334352256A3557074950379ABC2C09564EC0FBBF41760BE77485
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5733.REALTIME=1728322447558921.MONOTONIC=155728840.CONTROLLER=:1.17.

/run/systemd/sessions/.#c2cDnHHh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.4646318836345555
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB1vrgdwoTme:qgFqPuFNuCH0nI9x2xayW1vrgdw6me
MD5:	DC505B2211FE15F0324B8C8A01C133C0
SHA1:	70FA932BD599AC52C84F4016FC212E804B9CD7D1
SHA-256:	C9BE7021EDB8151E3BD5984429CC8E0872C030AC1EC552E6BBB0484E0E74D323
SHA-512:	A4D9CCCD86EFBBF6231BA86C49615E8969E16F16BE79B463041C51B3836BAF47711A6642F0ED658E4C1FF3D383AAB65F783E9FFAC124CA64ED474027534A4B43
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5733.REALTIME=1728322447558921.MONOTONIC=155728840.CONTROLLER=:1.17.DEVICES=13:65 13:66 13:67 13:64 .

/run/systemd/sessions/.#c2ulIOXl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.451063375688948
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB1vrgdwoTAn:qgFqPuFNuCH0nI9x2xayW1vrgdw6A
MD5:	5733F4FC65B52220795A3E6DE6A18944
SHA1:	5D9D6BCCC86956FE65C02F2EC9A296BD694938F8
SHA-256:	68E7767A555D552E57088B4B910536B5DE157FAAF2C46673349BE4C7B6D4E0D5
SHA-512:	1E2B477B9AF78904F36AE4FD8BC41866E5E4F06C4D1F73C16C73EBA63FA0BD352CDB20FBC0AC4A4E319D00A57016D1F1CA5EC4045ECF6EF467330B4DC70FC7BF
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5733.REALTIME=1728322447558921.MONOTONIC=155728840.CONTROLLER=:1.17.DEVICES=13:64 13:65 .

/run/systemd/users/.#1276pOcrj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.149347161997554
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgd977JQ2z5c2zw02zb2owB:qgFq30NzL/ixxTgd979jz5HzwPzbA
MD5:	E7D771B126EA2B549AB86B50EC5954E4
SHA1:	B56833FEC9B93F1ED3E44E026B7C2D003391E4E9
SHA-256:	301BB418B6C89F8C460242B8BEE41AE5B587AD84465DB860D1D48D2E236418BA
SHA-512:	A8992D46DB45F720FEEE0C1ABFBBBCB834CF74CE6B4E7AEA0FE4C20199592E9C7441FF4346A0A3C5ADBA3D5C82E47DE9FFE6A14B8A409DE909F293D29588E6EF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127B6Mv1l

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.157407271903148
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgd977JQ2thQc2x9sS02/g2owB:qgFq30NzL/ixegd979jthQHxbPYA
MD5:	FAFF83C422D43D30275879E3113DF760
SHA1:	F607C22DDF580CD626B1AC48F8FD339FB0C55E51
SHA-256:	ADD186B0BDB08313BF88C485C44A6672161AD2CBD06502170521224EA37A1E04
SHA-512:	1F8D63354840F9E2030C842EA2915DF8D493B0483238BD2FF4FD7154855BFB8C9E78B31FAAEDF59C664ED1436929C9C407B8FA565826BA8AFE3746CFDD4BEBBB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127F9Aebj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.144314734058286
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgd977JQ2z5c2zw02zb2owB:qgFq30z1cL/iRJgd979jz5HzwPzbA
MD5:	1F8A2319D28CB0999F89EBBB8D5DA8DC
SHA1:	C87051F9846A65EB27FB5D042A19643777DAAD15
SHA-256:	97F53ED746F3CB89CC2BD97584C863BE1D5F44F2623B78943D74E944624FEA89
SHA-512:	D63851634D0463E0D033C7D12406E5D6088835CB0C2431B639A40B3721A2BC3FF5BF3DD04CF580A07E4269D5B08EAA247DB9E48D083ABA41062462981789A869
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127JnvAek

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.158464637338755
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgd977JQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegd979jthQHtPnmDq9x
MD5:	748B9E289412C0BF9B29D9558A871740
SHA1:	5B483B1B47AD80EB5BD87572252902F3C19AD80A
SHA-256:	3A9E5ADF56B6C56DB1FE775D40E00702CD8C42F4E5F481C11E5B99A8F7987988
SHA-512:	DC61B053713105F712F90344A9594CA43F9FE7A588C5CE0D65D427E96609862EC339A5CE7CF164AA4ED3077E77DF44CAA0DBB79F6B28FEF13217868B1139D2FE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127SPRW1i

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.17376639436963
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgd977JQ2thQc2x9sS02nmD2owC:qgFq30dAL/ixegd979jthQHxbPnmDd
MD5:	EBA30F3988FA7F92DE68D0C738E5D70B
SHA1:	2515FE3985E58C7A79C71F9A347D8F66AA1A7E3D
SHA-256:	7468B78EE6EA1C221835CECFF37A0B1AB2972725F1FB775A08755D12C1F6F9AE
SHA-512:	C3517FFD90C381D5BE1CD35E86CC78A5FA7AD3859872FDACCD0E2EAA0AA50E85AD32EC1246A1462DD2EB84F28D418296FE8DF2B2F3033BF2585D44D3E46495C4
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127T7vfdi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.165283416977634
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgd977JQ2z5c2zw02zb2owB:qgFq30z1cL/ixxTgd979jz5HzwPzbA
MD5:	034A3E97295F79545F0A25861795F45A
SHA1:	01FB2033E879A5D12EE7739027EA734462984BB4
SHA-256:	2428E358637C8398DCCEFC8540BB20CAB9F33CBEA0CBDA05F4D325036C31ABFF
SHA-512:	2DDA1D15399B2C38D9D5FA1A60A6BFBFFE35BB75E83D6C929E60C25B4A44DF4E9633E6B8886EF0FF69FBF2411DACE8EC9FBB44818238C91D3901700F7590EE78
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127TGqIMk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.164235364237127
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgd977JQ2thQc2pb02/g2p9rwB:qgFq30z1cL/ixegd979jthQHtPYq9M
MD5:	ED71AB8F14BE1D5D4749E872F2B73E8D
SHA1:	E43759F28E81FC2B0D6B607DDC34AF89A323CD2D
SHA-256:	C8B6670E18A4095D170163F6FAC7E1FE499EF786D6333DFBB7111A47FC2E1630
SHA-512:	EDE87185551DF6713A3CDA2920280B24DD54C208B14D50370726FB93A8E31720936EFAC06FEC8CEAE005402C88EAC789F714C29ED2BDEF19F93DB869515A8332
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ZjGqYj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.164235364237127
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgd977JQ2thQc2pb02/g2p9rwB:qgFq30z1cL/ixegd979jthQHtPYq9M
MD5:	ED71AB8F14BE1D5D4749E872F2B73E8D
SHA1:	E43759F28E81FC2B0D6B607DDC34AF89A323CD2D
SHA-256:	C8B6670E18A4095D170163F6FAC7E1FE499EF786D6333DFBB7111A47FC2E1630
SHA-512:	EDE87185551DF6713A3CDA2920280B24DD54C208B14D50370726FB93A8E31720936EFAC06FEC8CEAE005402C88EAC789F714C29ED2BDEF19F93DB869515A8332
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127a6R6zk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.3098274336801135
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffs7gd977JQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBAgd979jthQHtPYq9M
MD5:	B78573CF7A31FCE7926DF4D095B1E584
SHA1:	26C67332E666FD90DE64725D097DBF4130EE40DE
SHA-256:	391D61CDD464361970C2BBE45DC3C396F1C796FCBC15129DB5D0DFE9686FB836
SHA-512:	4E9FAC53354B00925B8E3FA64D3800B98C031042C2D883F3795D57633EB5BE0E171047E3AAF9A777323229F3F8156620F727FBC2F7BF0AAAB19A075784BC51ED
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7749.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127lmHoxj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3316367241528635
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6ufgd977JQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBi6gd979jthQHtPYqi
MD5:	604B013394E44A562EE5412538F962B9
SHA1:	04D025F5902D56A09DE7B8ED1A1057C1A0710D81
SHA-256:	858AAB5C80C5CB7B8450F3BCD583E2F866168D15F24DD4A3DD9E1E0F48925A80
SHA-512:	4F0064F812488746D005577ABB9BE6FD4826C4186AA0EBCA415C1F27A5B0B9F7590B6F1CE72B0CA30C2C5C74C0C64D07CDA3B8120EA07C35C6D050601D31D6C5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7749.DISPLAY=c1.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127lqzANl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127usWfsj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.158464637338755
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgd977JQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegd979jthQHtPnmDq9x
MD5:	748B9E289412C0BF9B29D9558A871740
SHA1:	5B483B1B47AD80EB5BD87572252902F3C19AD80A
SHA-256:	3A9E5ADF56B6C56DB1FE775D40E00702CD8C42F4E5F481C11E5B99A8F7987988
SHA-512:	DC61B053713105F712F90344A9594CA43F9FE7A588C5CE0D65D427E96609862EC339A5CE7CF164AA4ED3077E77DF44CAA0DBB79F6B28FEF13217868B1139D2FE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322435666720.MONOTONIC=143836640.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:xo:6
MD5:	CD9E3270B175E1D945CC7BC5815DA2C4
SHA1:	EF758671E2ABD2EC09F08AC3D2FCB2B20EE356B7
SHA-256:	1805469A17F84DB066EF8AC963C56F0EDE0F9BF3C2148D8ACE83CEAF178CBED4
SHA-512:	2EA4FB37DFB2EA4006E27C4DA30C8C67C691A2D2D05E3B207BD8E8F7B33724AD14C3E0FD9D47EE1D642FF62B2F81869F90024021F065F63304CF7710C72E012F
Malicious:	false
Preview:	6193.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.002280383418467
Encrypted:	false
SSDEEP:	12:OxPbYyveY+bYIO3xPGtu8jveY+GtudlRSxPDQXwveY+D44xPUBKiveY+U3BQZ0vv:w4skt3tInVXIr86BPav1k+1It8d1tTqd
MD5:	81F415CB36B1B70E3387B523E26C8F58
SHA1:	A0903C4465F684664EFC25F00D18096FFFB69140
SHA-256:	B05D4C5EBE2DC7D6132910EF060EAB6039D9F03CA35707B9F86574CF5628824E
SHA-512:	E74BD4424DE3927EF1601C1EDA72FA7E07AA0ECD6C0252F2BC057F646EA6EDF6D5C75928174862C483DD28FB74C32CAEFF128026A5F868E3E26C64D0C326164F
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5771..MIT-MAGIC-COOKIE-1.....MR..*.3..1..p..XSMP...#local/galassia:@/tmp/.ICE-unix/5771..MIT-MAGIC-COOKIE-1...4..,.7~..)O.....ICE...!unix/galassia:/tmp/.ICE-unix/5684..MIT-MAGIC-COOKIE-1..i~...`.U/....?.~..ICE...#local/galassia:@/tmp/.ICE-unix/5684..MIT-MAGIC-COOKIE-1..7".......H....2..XSMP...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1.....w.0......F!W...XSMP...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1......,mN..b7.....ICE...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....]v1..".?.}.....ICE...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1...o4...6]..c..f....XSMP...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1..N.#r......S.....XSMP...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....q.p.."LS.DM(..ICE...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...]...,0..2...`..ICE...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...y.&.O...j../I....XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.983294787198871
Encrypted:	false
SSDEEP:	3:rg/WFllasO93wlZg4fmltHNWFllasO93wlZg4f0:rg/WFl2A8SStHNWFl2A8S0
MD5:	A692F9DA240292740901BA5EDE0993A7
SHA1:	1FEE28DA713824A713A3F29E9C311C2D8F3FE116
SHA-256:	426D3E62D7946E308FFEBF87FDF0E6B894C9F9BD116D2CFFFD54870FD47DED95
SHA-512:	B25F23A3F3AB7BC93163F24EF42EB58F0F1E5C90513CDA575D4C31DBBA0D15526C5BC0CC7C859D87A270068AE2EC8776C55BC2AD30EA37D3CB865A75899FBFB6
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1...t:..f2...b......galassia....MIT-MAGIC-COOKIE-1...t:..f2...b..

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:q:q
MD5:	C0599731DFC6B30CE3398FB7D2922C36
SHA1:	4CFAD854ABC3177A67E12DCC3A951169C74C7235
SHA-256:	D234D642819C661A856F16C1B1DE069E8BD3996A9A55111827C765FD915B3078
SHA-512:	CC40149D1B96A2B10E472ACF059A6E5A7793F5BA5E06192281B39C924DB2B449871DBD1F7155D842BF8BF34A0DDC6C0EEE832A4991668400619277B6F75CEE82
Malicious:	false
Preview:	6067.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6667178117422344
Encrypted:	false
SSDEEP:	3:ECsXlXEWtl/Ql/4:++ylY
MD5:	FBA2A3DAAFE45F9A38563CEBAE4D1DAC
SHA1:	D35E9522370213C853514C9861444864C3A3EEC4
SHA-256:	316803BFD83CBA2A90D02663D67691902319179B4EC2644EB6DB2B3FD4CB4B63
SHA-512:	CC302A35F7CE93E5A3DD67820052042C4AFFFC2BC278F971BA40F17DEE56A4DAC989596F682D074012849C4226DF03A7F5806DA91DB252CA0C008C620C64D0AF
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................t..g.J......................................

/tmp/qemu-open.Lx3zZD (deleted)

Download File

Process:	/tmp/0wG3Y7nLHa.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgVwXp2LG:TgV6n
MD5:	1D4C2812524BFF0F82A8D6AB59ED2045
SHA1:	58EB86A0E6C457481FB7128269EC5B0C8F9778D0
SHA-256:	CAA845FD75DF257C9BF128676CEE991EC75B24D82934A021BDA4DF2A240B9995
SHA-512:	B59BDAA90150F73473EC4611F23F92080A813C5A9E14901E3D2AB962FA5D15519E1B4049E82B4D022245B3FF3840C4C6A5F7BC689EF09E51D878416CC1B6CEDA
Malicious:	false
Preview:	/tmp/0wG3Y7nLHa.elf.

/tmp/qemu-open.mx8Hpc (deleted)

Download File

Process:	/tmp/0wG3Y7nLHa.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgVwXp2LG:TgV6n
MD5:	1D4C2812524BFF0F82A8D6AB59ED2045
SHA1:	58EB86A0E6C457481FB7128269EC5B0C8F9778D0
SHA-256:	CAA845FD75DF257C9BF128676CEE991EC75B24D82934A021BDA4DF2A240B9995
SHA-512:	B59BDAA90150F73473EC4611F23F92080A813C5A9E14901E3D2AB962FA5D15519E1B4049E82B4D022245B3FF3840C4C6A5F7BC689EF09E51D878416CC1B6CEDA
Malicious:	false
Preview:	/tmp/0wG3Y7nLHa.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.CAFBV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.TPVEV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.1483245877441135
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWW4TMrsHDN1E:q5sU3LWfLUDmQymqSFbfomSHrwDLfM
MD5:	C2813DA3C2A6CA0B358717BC9C05CA4F
SHA1:	4C573F2F5EE0B861C0C3DA4069631A7D7FA3DDDB
SHA-256:	5084ABE2CE96D77C35C2F29217D9C843C01C4E36D0B28D2ED86A3CF05F58DDFE
SHA-512:	30FC524C831FC9D71A410335C8A9C5C56821834C84876FBE858A6A535C7DC585B05BBB050D1436E349EDB598693913430059032663471B4F987AB99435A4ACCA
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-C82TAOup,guid=8cec49a809eb7499022f010a67041bc0.IBUS_DAEMON_PID=5994.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.283970333938904
Encrypted:	false
SSDEEP:	384:BLJnY0c9M1d4dydR6dCdfdcdjd/dUdDd1dNdqdldsd6hdQdKdJdjdtSdQqdQSdws:dJnhr/72uSvyPHbN5wW8e
MD5:	FCB882FBC069E5C443074D8A974AD0AA
SHA1:	3248D241687F74C85901050A9C55F1326BD0330A
SHA-256:	296450F9092C700638F20EED446E3D1569DFF61E5D9EED7E1BC687ECC926D9A1
SHA-512:	1BB779598A5CAB9A0F43D1FAF4143006AB52393184198056E0F8EFD4A5C80F98286BFC05C56ABD84E1B67B49E0864E6EF289A00550E4BCBDD263015983716531
Malicious:	false
Preview:	[ 157.473] (--) Log file renamed from "/var/log/Xorg.pid-5749.log" to "/var/log/Xorg.0.log".[ 157.499] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 157.518] Build Operating System: linux Ubuntu.[ 157.528] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 157.539] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 157.576] Build Date: 06 July 2021 10:17:51AM.[ 157.595] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 157.607] Current version of pixman: 0.38.4.[ 157.617] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 157.630] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2435
Entropy (8bit):	4.975653380352703
Encrypted:	false
SSDEEP:	24:u8/xI9tFd46Z406Ze10Bc7cCdNyAv6yA2+VIipWR7GWDrCQHOgbOiFd4OVNKsrdn:zxEjvsfVCBDrC1gKgn60ODrboIDrCn
MD5:	C75EFC23B60C134773C2FB34C16680F0
SHA1:	D99440A604AFF98E071229A995729CBBDD9DDDC0
SHA-256:	1EADC4AE551A69F988F7A679DB594822269AB69CE58BFA0AAEF431C1CE3E7FA6
SHA-512:	49E1237191B860F5C45CC63B76F79FAA13BDE9BFC27632F9C275C100E4D38D1742C781C54BF0C5F9A3EEF77FC07E5FCEF81D76A60DA389988846F4F5B992F69C
Malicious:	false
Preview:	Oct 7 12:33:30 galassia systemd-logind[801]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Oct 7 12:33:30 galassia systemd-logind[801]: Session c2 logged out. Waiting for processes to exit..Oct 7 12:33:34 galassia systemd-logind[5556]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 7 12:33:34 galassia systemd-logind[5556]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 7 12:33:34 galassia systemd-logind[5556]: User enumeration failed: Invalid argument.Oct 7 12:33:34 galassia systemd-logind[5556]: User of session c2 not known..Oct 7 12:33:34 galassia systemd-logind[5556]: User of session 2 not known..Oct 7 12:33:34 galassia systemd-logind[5556]: Session enumeration failed: No such file or directory.Oct 7 12:33:35 galassia systemd-logind[5556]: Watching system buttons on /dev/input/event0 (Power Button).Oct 7 12:33:35 galassia systemd-logind[5556]: Watching system buttons on /dev/input/event1 (AT Transl

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	42866
Entropy (8bit):	4.722465703805145
Encrypted:	false
SSDEEP:	384:Qa1FgxTVUKAHf0Lp0uK7qoW9c2vYdscQXiph4/sTTlQYb3XQkGAvZowtAv3w21RP:Qa3glVUKAHf0Lp0uK7qoW9FUT+e8Ei
MD5:	6E0BA36381F5A92A8AF7D12B1986DEEF
SHA1:	EF86B2B661B10F0EBCF287723600493A6F23314F
SHA-256:	2CFCDBEAF11D41AD07CD70A9771037B6CDFF2D94D8665C35D034AADC52F17C20
SHA-512:	1BC163BFF212D9E86DC93AD3DC70C53990EB1FFB60DA268EE734CC97330BEC6882B169A5ED01286D69D7A083F63636D619C0DDECA5CC81B64049FC38BD73D754
Malicious:	false
Preview:	Oct 7 12:33:32 galassia kernel: [ 118.300462] blocking signal 9: 5488 -> 780.Oct 7 12:33:32 galassia kernel: [ 118.778797] blocking signal 9: 5488 -> 940.Oct 7 12:33:32 galassia kernel: [ 118.941468] blocking signal 9: 5488 -> 1289.Oct 7 12:33:32 galassia kernel: [ 119.509509] blocking signal 9: 5488 -> 3094.Oct 7 12:33:32 galassia kernel: [ 119.651291] blocking signal 9: 5488 -> 3157.Oct 7 12:33:32 galassia kernel: [ 119.832178] blocking signal 9: 5494 -> 661.Oct 7 12:33:32 galassia kernel: [ 120.072449] blocking signal 9: 5494 -> 725.Oct 7 12:33:32 galassia kernel: [ 120.192106] blocking signal 9: 5494 -> 780.Oct 7 12:33:32 galassia kernel: [ 120.245669] blocking signal 9: 5494 -> 940.Oct 7 12:33:32 galassia kernel: [ 120.471735] blocking signal 9: 5494 -> 1289.Oct 7 12:33:32 galassia kernel: [ 120.650241] New task spawned: old: (tgid 5540, tid 5540), new (tgid: 5540, tid: 5548).Oct 7 12:33:32 galassia kernel: [ 120.651649] New task spawned: old: (tgid 5540, t

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	152340
Entropy (8bit):	5.214177118761901
Encrypted:	false
SSDEEP:	768:MDKRN1kgrVUKEHf0jp0uO7qoU9iRsSDxk604jEs+/MbPbub6b4babnbybmb9bWb+:yznD9LjEs+/RFe8EJ
MD5:	B7A319ECADC76CC1142EC44E1A201EC8
SHA1:	F7311327B11FB01F273F582842A8B04EA6C9ABCB
SHA-256:	6CAD6C2734AADD8569CAB3A31B0B5B942A385DC20421B67CA091B4BDA6AD22A5
SHA-512:	0F37F0DDBEC577DC5342FA7CB8DAEA4F804FB2622CD65C2A6E05F36F7C3994B141DE9DB5237684366DAAC5E3788D62D214F80EF87EDE316E25E203CD5462601E
Malicious:	false
Preview:	Oct 7 12:33:30 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 7 12:33:30 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 7 12:33:30 galassia systemd[1]: session-c2.scope: Succeeded..Oct 7 12:33:30 galassia systemd[1299]: pulseaudio.service: Succeeded..Oct 7 12:33:30 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Oct 7 12:33:30 galassia systemd[1]: Stopped System Logging Service..Oct 7 12:33:30 galassia systemd[1]: Starting System Logging Service....Oct 7 12:33:30 galassia systemd[2955]: pulseaudio.service: Scheduled restart job, restart counter is at 1..Oct 7 12:33:30 galassia systemd[2955]: Stopped Sound Service..Oct 7 12:33:30 galassia systemd[2955]: Starting Sound Service....Oct 7 12:33:30 galassia systemd[1299]: dbus.service: Main process exited, code=killed, status=9/KILL.Oct 7 12:33:30 galassia systemd[1299]: dbus.service: Failed with result 'signal'..Oct 7 12:33:

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6667178117422344
Encrypted:	false
SSDEEP:	3:ECsXlXEWtl/Ql/4:++ylY
MD5:	FBA2A3DAAFE45F9A38563CEBAE4D1DAC
SHA1:	D35E9522370213C853514C9861444864C3A3EEC4
SHA-256:	316803BFD83CBA2A90D02663D67691902319179B4EC2644EB6DB2B3FD4CB4B63
SHA-512:	CC302A35F7CE93E5A3DD67820052042C4AFFFC2BC278F971BA40F17DEE56A4DAC989596F682D074012849C4226DF03A7F5806DA91DB252CA0C008C620C64D0AF
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................t..g.J......................................

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.041490279748451
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	0wG3Y7nLHa.elf
File size:	71'120 bytes
MD5:	37011bc117aeefdd95a21340b307c6c3
SHA1:	ba3e3de95acc8cb1df691e253a602578a2d16dda
SHA256:	fbdac2d501e594da8a50deb6b1120e92fac6ef477993a107b7d4b2740ae3e620
SHA512:	45f94d5498a451730b89f8c96cc8943bf55eddd755ced23237db90a65ce8607c1dffab20f7fc914f756aef7dacef7216bf9f3deba72fa65b832f98f1a69efdde
SSDEEP:	1536:uyLtFZDY9Pvaw+cMqPtgcULOKMh5ExkrvbEb:uy5Fd8aw+KSLOtuOb2
TLSH:	8C633A91BC815612C6D112BBFB6E428C372A53A8D2EF32079D266F5137C792F0E7B641
File Content Preview:	.ELF...a..........(.........4...@.......4. ...(.........................................................\|&..........Q.td..................................-...L."....=..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70720
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xf474	0x0	0x6	AX	16
.fini	PROGBITS	0x17524	0xf524	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x17538	0xf538	0x15bc	0x0	0x2	A	4
.ctors	PROGBITS	0x21000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x21008	0x11008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x21014	0x11014	0x3ec	0x0	0x3	WA	4
.bss	NOBITS	0x21400	0x11400	0x227c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x11400	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x10af4	0x10af4	6.1392	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x11000	0x21000	0x21000	0x400	0x267c	2.5923	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 19:33:28.080123901 CEST	192.168.2.14	8.8.8.8	0xaa84	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:29.874628067 CEST	192.168.2.14	8.8.8.8	0x61f6	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 19:33:28.087013006 CEST	8.8.8.8	192.168.2.14	0xaa84	No error (0)	byte-mirai.kro.kr		154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:29.882677078 CEST	8.8.8.8	192.168.2.14	0x61f6	No error (0)	byte-mirai.kro.kr		154.216.20.119	A (IP address)	IN (0x0001)	false

Start time (UTC):	17:33:27
Start date (UTC):	07/10/2024
Path:	/tmp/0wG3Y7nLHa.elf
Arguments:	/tmp/0wG3Y7nLHa.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	17:33:30
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:33:33
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:34
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:35
Start date (UTC):	07/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:33:36
Start date (UTC):	07/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	17:33:37
Start date (UTC):	07/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	17:33:40
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:39
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:41
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:51
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:52
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:33:53
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:33:56
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 0wG3Y7nLHa.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5688/oom_score_adj

/proc/5691/oom_score_adj

/proc/5693/oom_score_adj

/proc/5695/oom_score_adj

/proc/5697/oom_score_adj

/proc/5699/oom_score_adj

/proc/5704/oom_score_adj

/proc/5785/oom_score_adj

/proc/5815/oom_score_adj

/proc/5818/oom_score_adj

/proc/5820/oom_score_adj

/proc/5822/oom_score_adj

/proc/5824/oom_score_adj

/proc/5826/oom_score_adj

/proc/5829/oom_score_adj

/proc/6008/oom_score_adj

/proc/6181/oom_score_adj

/proc/6199/oom_score_adj

/proc/6264/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1UMWL7i

/run/systemd/inhibit/.#2DgL7Pl

/run/systemd/inhibit/.#3961hkj

/run/systemd/inhibit/.#4wMaZ0h

/run/systemd/inhibit/.#5jiKWMj

Linux Analysis Report
0wG3Y7nLHa.elf

Start time (UTC):	17:33:57
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --nofork --print-address 4 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:33:58
Start date (UTC):	07/10/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Start time (UTC):	17:33:59
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:34:00
Start date (UTC):	07/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	17:34:04
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:34:08
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	17:34:09
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	17:34:24
Start date (UTC):	07/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	17:34:56
Start date (UTC):	07/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	17:34:31
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc