Edit tour

Linux Analysis Report
cenSXPimaG.elf

Overview

General Information

Sample name:	cenSXPimaG.elf renamed because original name is a hash value
Original sample name:	6852b0e84e22d0dbaa82ad63136ceddb.elf
Analysis ID:	1528335
MD5:	6852b0e84e22d0dbaa82ad63136ceddb
SHA1:	2d60977be464c521872bc5c9c6560d95fb42d37b
SHA256:	ce2b7129023bb0aff9b29fb0bce30474f2aa655aa7c16d3c2ef8365a6e3f6c85
Tags:	32armelfmirai
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528335
Start date and time:	2024-10-07 19:37:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	cenSXPimaG.elf renamed because original name is a hash value
Original Sample Name:	6852b0e84e22d0dbaa82ad63136ceddb.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/98@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: cenSXPimaG.elf

Process Tree

system is lnxubuntu20

cenSXPimaG.elf (PID: 5491, Parent: 5416, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/cenSXPimaG.elf

cenSXPimaG.elf New Fork (PID: 5493, Parent: 5491)

cenSXPimaG.elf New Fork (PID: 5495, Parent: 5491)

cenSXPimaG.elf New Fork (PID: 5497, Parent: 5491)

cenSXPimaG.elf New Fork (PID: 5499, Parent: 5497)

cenSXPimaG.elf New Fork (PID: 5500, Parent: 5497)

cenSXPimaG.elf New Fork (PID: 5502, Parent: 5497)

cenSXPimaG.elf New Fork (PID: 5504, Parent: 5497)

cenSXPimaG.elf New Fork (PID: 5506, Parent: 5497)

systemd New Fork (PID: 5539, Parent: 1)

dbus-daemon (PID: 5539, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 5548, Parent: 1289)

Default (PID: 5548, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5552, Parent: 2955)

pulseaudio (PID: 5552, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gdm3 New Fork (PID: 5553, Parent: 1289)

Default (PID: 5553, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5554, Parent: 1)

rsyslogd (PID: 5554, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 5555, Parent: 1289)

Default (PID: 5555, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gvfsd-fuse New Fork (PID: 5556, Parent: 3147)

fusermount (PID: 5556, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5565, Parent: 1)

rtkit-daemon (PID: 5565, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5568, Parent: 1)

systemd-logind (PID: 5568, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5627, Parent: 1)

polkitd (PID: 5627, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5631, Parent: 1)

gpu-manager (PID: 5631, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5632, Parent: 5631)

sh (PID: 5632, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5634, Parent: 5632)

grep (PID: 5634, Parent: 5632, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5637, Parent: 5631)

sh (PID: 5637, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5638, Parent: 5637)

grep (PID: 5638, Parent: 5637, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5639, Parent: 5631)

sh (PID: 5639, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5640, Parent: 5639)

grep (PID: 5640, Parent: 5639, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5641, Parent: 5631)

sh (PID: 5641, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5642, Parent: 5641)

grep (PID: 5642, Parent: 5641, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5643, Parent: 5631)

sh (PID: 5643, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5644, Parent: 5643)

grep (PID: 5644, Parent: 5643, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5645, Parent: 5631)

sh (PID: 5645, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5646, Parent: 5645)

grep (PID: 5646, Parent: 5645, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5647, Parent: 5631)

sh (PID: 5647, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5648, Parent: 5647)

grep (PID: 5648, Parent: 5647, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5649, Parent: 5631)

sh (PID: 5649, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5650, Parent: 5649)

grep (PID: 5650, Parent: 5649, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5633, Parent: 1)

agetty (PID: 5633, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5655, Parent: 1)

generate-config (PID: 5655, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5656, Parent: 5655)

pkill (PID: 5656, Parent: 5655, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5657, Parent: 1)

gdm-wait-for-drm (PID: 5657, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5662, Parent: 1)

gdm3 (PID: 5662, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5667, Parent: 5662)

plymouth (PID: 5667, Parent: 5662, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5685, Parent: 5662)

gdm-session-worker (PID: 5685, Parent: 5662, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5689, Parent: 5685)

gdm-wayland-session (PID: 5689, Parent: 5685, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5695, Parent: 5689)

dbus-run-session (PID: 5695, Parent: 5689, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5696, Parent: 5695)

dbus-daemon (PID: 5696, Parent: 5695, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5700, Parent: 5696)

dbus-daemon New Fork (PID: 5701, Parent: 5700)

false (PID: 5701, Parent: 5700, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5703, Parent: 5696)

dbus-daemon New Fork (PID: 5704, Parent: 5703)

false (PID: 5704, Parent: 5703, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5705, Parent: 5696)

dbus-daemon New Fork (PID: 5706, Parent: 5705)

false (PID: 5706, Parent: 5705, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5707, Parent: 5696)

dbus-daemon New Fork (PID: 5708, Parent: 5707)

false (PID: 5708, Parent: 5707, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5709, Parent: 5696)

dbus-daemon New Fork (PID: 5710, Parent: 5709)

false (PID: 5710, Parent: 5709, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5711, Parent: 5696)

dbus-daemon New Fork (PID: 5712, Parent: 5711)

false (PID: 5712, Parent: 5711, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5716, Parent: 5696)

dbus-daemon New Fork (PID: 5717, Parent: 5716)

false (PID: 5717, Parent: 5716, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5697, Parent: 5695)

gnome-session (PID: 5697, Parent: 5695, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5697, Parent: 5695, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5718, Parent: 5697)

session-migration (PID: 5718, Parent: 5697, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5719, Parent: 5697)

sh (PID: 5719, Parent: 5697, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5719, Parent: 5697, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5747, Parent: 5662)

gdm-session-worker (PID: 5747, Parent: 5662, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5752, Parent: 5747)

gdm-x-session (PID: 5752, Parent: 5747, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5754, Parent: 5752)

Xorg (PID: 5754, Parent: 5752, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5754, Parent: 5752, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5754, Parent: 5752, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5768, Parent: 5754)

sh (PID: 5768, Parent: 5754, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5769, Parent: 5768)

xkbcomp (PID: 5769, Parent: 5768, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6017, Parent: 5754)

sh (PID: 6017, Parent: 5754, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6021, Parent: 6017)

xkbcomp (PID: 6021, Parent: 6017, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5774, Parent: 5752)

Default (PID: 5774, Parent: 5752, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5775, Parent: 5752)

dbus-run-session (PID: 5775, Parent: 5752, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5776, Parent: 5775)

dbus-daemon (PID: 5776, Parent: 5775, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5792, Parent: 5776)

dbus-daemon New Fork (PID: 5793, Parent: 5792)

at-spi-bus-launcher (PID: 5793, Parent: 5792, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5798, Parent: 5793)

dbus-daemon (PID: 5798, Parent: 5793, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6179, Parent: 5798)

dbus-daemon New Fork (PID: 6180, Parent: 6179)

at-spi2-registryd (PID: 6180, Parent: 6179, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5820, Parent: 5776)

dbus-daemon New Fork (PID: 5821, Parent: 5820)

false (PID: 5821, Parent: 5820, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5823, Parent: 5776)

dbus-daemon New Fork (PID: 5824, Parent: 5823)

false (PID: 5824, Parent: 5823, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5825, Parent: 5776)

dbus-daemon New Fork (PID: 5826, Parent: 5825)

false (PID: 5826, Parent: 5825, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5827, Parent: 5776)

dbus-daemon New Fork (PID: 5828, Parent: 5827)

false (PID: 5828, Parent: 5827, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5829, Parent: 5776)

dbus-daemon New Fork (PID: 5830, Parent: 5829)

false (PID: 5830, Parent: 5829, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5831, Parent: 5776)

dbus-daemon New Fork (PID: 5832, Parent: 5831)

false (PID: 5832, Parent: 5831, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5836, Parent: 5776)

dbus-daemon New Fork (PID: 5837, Parent: 5836)

false (PID: 5837, Parent: 5836, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6022, Parent: 5776)

dbus-daemon New Fork (PID: 6023, Parent: 6022)

ibus-portal (PID: 6023, Parent: 6022, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6194, Parent: 5776)

dbus-daemon New Fork (PID: 6195, Parent: 6194)

gjs (PID: 6195, Parent: 6194, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6258, Parent: 5776)

dbus-daemon New Fork (PID: 6259, Parent: 6258)

false (PID: 6259, Parent: 6258, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5777, Parent: 5775)

gnome-session (PID: 5777, Parent: 5775, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5777, Parent: 5775, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5778, Parent: 5777)

gnome-session-check-accelerated (PID: 5778, Parent: 5777, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5799, Parent: 5778)

gnome-session-check-accelerated-gl-helper (PID: 5799, Parent: 5778, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5809, Parent: 5778)

gnome-session-check-accelerated-gles-helper (PID: 5809, Parent: 5778, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5838, Parent: 5777)

session-migration (PID: 5838, Parent: 5777, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5839, Parent: 5777)

sh (PID: 5839, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5839, Parent: 5777, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6012, Parent: 5839)

ibus-daemon (PID: 6012, Parent: 5839, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6016, Parent: 6012)

ibus-memconf (PID: 6016, Parent: 6012, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6019, Parent: 6012)

ibus-daemon New Fork (PID: 6020, Parent: 6019)

ibus-x11 (PID: 6020, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6243, Parent: 6012)

ibus-engine-simple (PID: 6243, Parent: 6012, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6216, Parent: 5777)

sh (PID: 6216, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6216, Parent: 5777, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6218, Parent: 5777)

sh (PID: 6218, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6218, Parent: 5777, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6220, Parent: 5777)

sh (PID: 6220, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6220, Parent: 5777, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6221, Parent: 5777)

sh (PID: 6221, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6221, Parent: 5777, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6222, Parent: 5777)

sh (PID: 6222, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6222, Parent: 5777, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6410, Parent: 6222)

gsd-print-notifications New Fork (PID: 6411, Parent: 6410)

gsd-printer (PID: 6411, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6223, Parent: 5777)

sh (PID: 6223, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6223, Parent: 5777, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6225, Parent: 5777)

sh (PID: 6225, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6225, Parent: 5777, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6226, Parent: 5777)

sh (PID: 6226, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6226, Parent: 5777, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6227, Parent: 5777)

sh (PID: 6227, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6227, Parent: 5777, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6232, Parent: 5777)

sh (PID: 6232, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6232, Parent: 5777, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6233, Parent: 5777)

sh (PID: 6233, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6233, Parent: 5777, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6235, Parent: 5777)

sh (PID: 6235, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6235, Parent: 5777, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6237, Parent: 5777)

sh (PID: 6237, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6237, Parent: 5777, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6241, Parent: 5777)

sh (PID: 6241, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6241, Parent: 5777, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gdm3 New Fork (PID: 5748, Parent: 5662)

Default (PID: 5748, Parent: 5662, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5749, Parent: 5662)

Default (PID: 5749, Parent: 5662, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5668, Parent: 1)

accounts-daemon (PID: 5668, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5678, Parent: 5668)

language-validate (PID: 5678, Parent: 5668, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5679, Parent: 5678)

language-options (PID: 5679, Parent: 5678, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5680, Parent: 5679)

sh (PID: 5680, Parent: 5679, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5681, Parent: 5680)

locale (PID: 5681, Parent: 5680, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5682, Parent: 5680)

grep (PID: 5682, Parent: 5680, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5693, Parent: 1299)

dbus-daemon (PID: 5693, Parent: 1299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5863, Parent: 2955)

dbus-daemon (PID: 5863, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5864, Parent: 2955)

pulseaudio (PID: 5864, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5866, Parent: 1)

systemd-localed (PID: 5866, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6029, Parent: 1)

upowerd (PID: 6029, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6067, Parent: 1299)

pulseaudio (PID: 6067, Parent: 1299, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6072, Parent: 1)

geoclue (PID: 6072, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6184, Parent: 1)

wpa_supplicant (PID: 6184, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6187, Parent: 1)

avahi-daemon (PID: 6187, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6189, Parent: 6187)

systemd New Fork (PID: 6192, Parent: 1)

packagekitd (PID: 6192, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6211, Parent: 6192)

dpkg (PID: 6211, Parent: 6192, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6260, Parent: 1)

systemd-hostnamed (PID: 6260, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6442, Parent: 1)

ModemManager (PID: 6442, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6505, Parent: 1)

colord (PID: 6505, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

systemd New Fork (PID: 6516, Parent: 1)

systemd-localed (PID: 6516, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
cenSXPimaG.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
cenSXPimaG.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5500.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5500.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5495.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5495.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5499.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5499.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5493.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5493.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5491.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5491.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5497.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5497.1.00007fdb84017000.00007fdb84027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5491	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5493	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5493	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5495	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5495	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5497	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5497	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5499	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5499	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5500	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: cenSXPimaG.elf PID: 5500	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 18 entries

String: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspctelnetbotdvrHelperbyte-mirai.kro.kr68.183.18.151

Source: global traffic

TCP traffic: 192.168.2.14:42178 -> 154.216.20.119:7777

Source: /usr/sbin/rsyslogd (PID: 5554)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5662)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5696)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5697)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5754)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5776)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5798)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5777)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 6012)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 162.28.167.71
Source: unknown	TCP traffic detected without corresponding DNS query: 125.175.140.221
Source: unknown	TCP traffic detected without corresponding DNS query: 167.146.20.195
Source: unknown	TCP traffic detected without corresponding DNS query: 213.7.89.137
Source: unknown	TCP traffic detected without corresponding DNS query: 91.179.115.4
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.224.111
Source: unknown	TCP traffic detected without corresponding DNS query: 131.7.117.82
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.183.24
Source: unknown	TCP traffic detected without corresponding DNS query: 31.28.69.120
Source: unknown	TCP traffic detected without corresponding DNS query: 201.107.196.188
Source: unknown	TCP traffic detected without corresponding DNS query: 216.140.94.189
Source: unknown	TCP traffic detected without corresponding DNS query: 138.112.143.134
Source: unknown	TCP traffic detected without corresponding DNS query: 115.88.75.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.26.17.37
Source: unknown	TCP traffic detected without corresponding DNS query: 111.183.116.219
Source: unknown	TCP traffic detected without corresponding DNS query: 58.74.189.25
Source: unknown	TCP traffic detected without corresponding DNS query: 203.131.52.210
Source: unknown	TCP traffic detected without corresponding DNS query: 80.103.7.53
Source: unknown	TCP traffic detected without corresponding DNS query: 60.34.190.197
Source: unknown	TCP traffic detected without corresponding DNS query: 61.147.207.214
Source: unknown	TCP traffic detected without corresponding DNS query: 84.51.230.110
Source: unknown	TCP traffic detected without corresponding DNS query: 176.136.151.48
Source: unknown	TCP traffic detected without corresponding DNS query: 171.134.50.96
Source: unknown	TCP traffic detected without corresponding DNS query: 162.77.169.132
Source: unknown	TCP traffic detected without corresponding DNS query: 169.179.203.238
Source: unknown	TCP traffic detected without corresponding DNS query: 126.42.221.100
Source: unknown	TCP traffic detected without corresponding DNS query: 126.214.59.141
Source: unknown	TCP traffic detected without corresponding DNS query: 138.254.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 151.130.12.211
Source: unknown	TCP traffic detected without corresponding DNS query: 62.216.95.153
Source: unknown	TCP traffic detected without corresponding DNS query: 219.245.29.56
Source: unknown	TCP traffic detected without corresponding DNS query: 105.123.92.9
Source: unknown	TCP traffic detected without corresponding DNS query: 183.36.121.43
Source: unknown	TCP traffic detected without corresponding DNS query: 189.114.81.105
Source: unknown	TCP traffic detected without corresponding DNS query: 220.205.11.166
Source: unknown	TCP traffic detected without corresponding DNS query: 206.228.77.151
Source: unknown	TCP traffic detected without corresponding DNS query: 109.86.133.8
Source: unknown	TCP traffic detected without corresponding DNS query: 160.225.156.83
Source: unknown	TCP traffic detected without corresponding DNS query: 191.118.232.43
Source: unknown	TCP traffic detected without corresponding DNS query: 168.127.214.52
Source: unknown	TCP traffic detected without corresponding DNS query: 201.233.100.191
Source: unknown	TCP traffic detected without corresponding DNS query: 153.167.71.158
Source: unknown	TCP traffic detected without corresponding DNS query: 200.46.4.116
Source: unknown	TCP traffic detected without corresponding DNS query: 157.36.255.173
Source: unknown	TCP traffic detected without corresponding DNS query: 173.189.172.72
Source: unknown	TCP traffic detected without corresponding DNS query: 194.253.82.120
Source: unknown	TCP traffic detected without corresponding DNS query: 44.109.49.88
Source: unknown	TCP traffic detected without corresponding DNS query: 213.212.227.37
Source: unknown	TCP traffic detected without corresponding DNS query: 220.255.98.183
Source: unknown	TCP traffic detected without corresponding DNS query: 140.46.163.41

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: syslog.30.dr, Xorg.0.log.149.dr	String found in binary or memory: http://wiki.x.org
Source: syslog.30.dr, Xorg.0.log.149.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.30.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 135, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 277, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 279, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 280, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 282, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 283, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 284, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 285, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 287, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 288, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 290, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 292, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 294, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 295, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 296, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 297, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 300, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 301, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 302, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 305, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 348, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 661, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 671, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 683, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 684, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 725, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 740, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 940, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent to PID below 1000: pid: 941, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 135, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 277, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 279, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 280, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 282, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 283, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 284, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 285, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 287, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 288, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 290, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 292, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 294, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 295, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 296, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 297, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 300, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 301, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 302, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 305, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 348, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 661, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 671, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 683, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 684, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 725, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 740, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 791, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 940, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent to PID below 1000: pid: 941, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1583, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3759, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3762, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1309, result: no such process	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1583, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3759, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3762, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5493, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5497, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5499, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5776)	SIGKILL sent: pid: 5792, result: successful
Source: /usr/bin/dbus-daemon (PID: 5776)	SIGKILL sent: pid: 6022, result: successful
Source: /usr/bin/dbus-daemon (PID: 5776)	SIGKILL sent: pid: 6194, result: successful
Source: /usr/bin/dbus-daemon (PID: 5798)	SIGKILL sent: pid: 6179, result: successful

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspctelnetbotdvrHelperbyte-mirai.kro.kr68.183.18.151

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1583, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3759, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 3762, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1309, result: no such process	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1583, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3125, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3329, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3759, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 3762, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5493, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5497, result: successful	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5499)	SIGKILL sent: pid: 5499, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5776)	SIGKILL sent: pid: 5792, result: successful
Source: /usr/bin/dbus-daemon (PID: 5776)	SIGKILL sent: pid: 6022, result: successful
Source: /usr/bin/dbus-daemon (PID: 5776)	SIGKILL sent: pid: 6194, result: successful
Source: /usr/bin/dbus-daemon (PID: 5798)	SIGKILL sent: pid: 6179, result: successful

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/98@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5539)	File: /proc/5539/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5556)	File: /proc/5556/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5696)	File: /proc/5696/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5776)	File: /proc/5776/mounts
Source: /usr/bin/dbus-daemon (PID: 5798)	File: /proc/5798/mounts
Source: /usr/bin/gjs (PID: 6195)	File: /proc/6195/mounts
Source: /usr/bin/gnome-shell (PID: 5839)	File: /proc/5839/mounts
Source: /usr/bin/dbus-daemon (PID: 5693)	File: /proc/5693/mounts
Source: /usr/bin/dbus-daemon (PID: 5863)	File: /proc/5863/mounts

Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/seats/.#seat0AblHmd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127AJG2qe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127Kruwaf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c14Ja1Rd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127qwtE8d	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/seats/.#seat0u6RhYd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127cl5MGd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c1GGbOZc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c12AHdig	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127OQKXJf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/seats/.#seat0KEKBAd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c1ZAsZ7b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#1271ZKlYd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c19GRI6f	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c1xTrlRb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c1HfuY7c	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127l0scEc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/seats/.#seat0aSlmyd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127zzHvNe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/seats/.#seat07VH0Jc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127EcKExd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/seats/.#seat0Jt3B2c	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#1272lIIef	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c2t6Ihfg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127Y6wzEf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/seats/.#seat0JZUsid	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c22QbOLf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c2yYwfnf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/users/.#127ndjdxe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c2Qr8PPc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c2hHUmMf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c2snNt1b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c2oHK34c	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/sessions/.#c2ALw2Zb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/inhibit/.#1npSKxf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/inhibit/.#2lqnKfc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5568)	File: /run/systemd/inhibit/.#36HiN9d	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5627)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5719)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5719)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5754)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5754)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5778)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5778)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5778)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5799)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5809)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5809)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5809)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5839)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5839)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5839)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5839)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5839)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5839)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5839)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6020)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6020)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6218)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6218)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6220)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6220)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6221)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6221)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6223)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6223)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6227)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6227)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-power (PID: 6241)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6241)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5668)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5668)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6029)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6029)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6192)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6260)	Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6442)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6442)	Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6505)	Directory: /var/lib/colord/.cache

Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3304/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/3425/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/cenSXPimaG.elf (PID: 5493)	File opened: /proc/269/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5632)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5637)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5639)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5641)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5643)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5645)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5647)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5649)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5768)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6017)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5680)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5634)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5638)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5640)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5642)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5644)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5646)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5648)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5650)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5682)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5656)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5633)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5662)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5662)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5668)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5668)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5554)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5554)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5631)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5754)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5631)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5754)	Truncated file: /var/log/Xorg.pid-5754.log

Source: /usr/bin/pulseaudio (PID: 5552)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5656)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5754)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5778)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5799)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5809)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5839)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5864)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6067)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/cenSXPimaG.elf (PID: 5491)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5552)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5554)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5631)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5633)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5685)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5697)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5747)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5752)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5754)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5793)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6180)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5777)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5778)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5799)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5809)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5839)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6020)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6218)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6220)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6221)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6225)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6227)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6241)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5864)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6067)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6187)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6192)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6260)	Queries kernel information via 'uname':

Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.975] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.050] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.674] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.872] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.514] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.287] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.977] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.984] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.727] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.578] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.274] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.798] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.816] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.358] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 171.338] (II) LoadModule: "vmware"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.931] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.255] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.948] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.710] (--) vmware(0): bpp: 32
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.034] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.342] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.629] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.571] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.532] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 171.367] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.109] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.041] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.326] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.508] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.112] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.548] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.298] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.635] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.028] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.680] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.899] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.370] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.069] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.235] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.803] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:29 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.443] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.013] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.263] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.901] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.644] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.564] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:34 galassia /usr/lib/gdm3/gdm-x-session[5754]: (WW) vmware(0): Disabling 3D support.
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.223] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.379] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.654] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.971] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.543] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.864] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.450] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 171.275] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.905] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.770] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.636] (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.720] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.121] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.150] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.008] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.622] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:29 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:34 galassia /usr/lib/gdm3/gdm-x-session[5754]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.274] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.768] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.959] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.580] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.696] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.193] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.094] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.941] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.821] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.173] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.758] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.209] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.813] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.482] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:31 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.985] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.112] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.611] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.714] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.222] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.648] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.718] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 172.337] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.074] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.410] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.135] (WW) vmware(0): Disabling 3D support.
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.864] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.936] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.285] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.811] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 181.538] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 181.629] (==) vmware(0): Backing store enabled
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.060] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 171.440] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.767] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.098] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:34 galassia /usr/lib/gdm3/gdm-x-session[5754]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.907] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.293] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.852] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 181.642] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.341] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.615] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.689] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.882] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.842] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.816] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.914] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.945] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.585] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.994] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.364] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.952] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.339] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.156] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.060] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.122] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.788] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.597] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.886] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.544] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.335] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.329] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): w.grn: 8
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.314] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.298] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.833] (--) vmware(0): w.red: 8
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.874] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.193] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.113] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.219] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.558] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.671] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: cenSXPimaG.elf, 5499.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.BL1ue1
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.194] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.041] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.805] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.913] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.949] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.590] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.126] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.779] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.253] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): depth: 24
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.708] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.796] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.169] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.389] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.885] (--) vmware(0): vis: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.093] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.855] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.565] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.397] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.312] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): RGB weight 888
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:40 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.603] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.992] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.320] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.141] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.038] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.000] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.134] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.262] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.389] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.823] (--) vmware(0): bpp: 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.354] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.186] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.283] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.105] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.490] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.921] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.828] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.616] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.422] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 181.552] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.938] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.913] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.857] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.201] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.278] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.511] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.560] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:34 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.642] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:30 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.873] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 181.559] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.425] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.733] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: cenSXPimaG.elf, 5491.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5493.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5495.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5497.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5499.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5500.1.000055e04715b000.000055e047289000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.730] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.183] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.483] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.166] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.153] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.587] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.267] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.292] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.574] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.794] (--) vmware(0): mheig: 885
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.054] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.831] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.922] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.607] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.652] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: cenSXPimaG.elf, 5491.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5493.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5495.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5497.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5499.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5500.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.427] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.522] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 181.636] (==) vmware(0): Silken mouse enabled
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.211] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.831] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.583] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.185] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): mwidt: 1176
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.654] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.255] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.652] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.138] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.968] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.418] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.889] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.716] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.028] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.248] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.788] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.357] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.018] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.685] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.988] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.393] (==) vmware(0): DPI set to (96, 96)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): vis: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.304] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.127] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.474] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.381] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.317] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.246] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.635] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.968] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.211] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.741] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.076] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.023] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.259] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.031] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: cenSXPimaG.elf, 5493.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.qWCuUx
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.146] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): DPI set to (96, 96)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.138] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.005] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.925] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.333] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.176] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.982] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.746] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.321] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.355] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.695] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.070] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.230] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.310] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 172.636] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.233] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.853] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.894] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.998] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.086] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.203] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.194] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 187.823] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.238] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.997] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: cenSXPimaG.elf, 5499.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.BL1ue1
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.275] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.304] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.496] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.520] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.552] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.636] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.013] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.371] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:40 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.845] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.304] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.415] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.556] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.120] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.297] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.882] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:29 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) LoadModule: "vmware"
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:34 galassia /usr/lib/gdm3/gdm-x-session[5754]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.975] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:30 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.314] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.964] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.003] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.574] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.228] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.502] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.999] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 176.160] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.307] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.473] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.916] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.500] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: cenSXPimaG.elf, 5493.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.qWCuUx
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.242] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.002] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.595] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 180.350] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:40 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.895] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.746] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.839] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.464] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:35 galassia /usr/lib/gdm3/gdm-x-session[5754]: (--) vmware(0): w.blu: 8
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.627] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.021] (==) vmware(0): Using HW cursor
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:36 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: cenSXPimaG.elf, 5491.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5493.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5495.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5497.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5499.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp, cenSXPimaG.elf, 5500.1.00007ffdac6cf000.00007ffdac6f0000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/cenSXPimaG.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/cenSXPimaG.elf
Source: cenSXPimaG.elf, 5491.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5493.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5495.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5497.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5499.1.000055e04715b000.000055e047289000.rw-.sdmp, cenSXPimaG.elf, 5500.1.000055e04715b000.000055e047289000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:38 galassia /usr/lib/gdm3/gdm-x-session[5754]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:40 galassia /usr/lib/gdm3/gdm-x-session[5754]: (==) vmware(0): Silken mouse enabled
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:46 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.326] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.30.dr	Binary or memory string: Oct 7 12:39:37 galassia /usr/lib/gdm3/gdm-x-session[5754]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.888] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.106] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 188.348] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 179.953] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 178.175] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 177.931] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5668)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: cenSXPimaG.elf, type: SAMPLE
Source: Yara match	File source: 5500.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5499.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5493.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5491.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5497.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5493, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5495, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5497, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5499, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5500, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: cenSXPimaG.elf, type: SAMPLE
Source: Yara match	File source: 5500.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5499.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5493.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5491.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5497.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5491, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5493, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5495, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5497, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5499, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5500, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: cenSXPimaG.elf, type: SAMPLE
Source: Yara match	File source: 5500.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5499.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5493.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5491.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5497.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5493, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5495, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5497, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5499, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5500, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: cenSXPimaG.elf, type: SAMPLE
Source: Yara match	File source: 5500.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5499.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5493.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5491.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5497.1.00007fdb84017000.00007fdb84027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5491, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5493, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5495, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5497, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5499, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cenSXPimaG.elf PID: 5500, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
cenSXPimaG.elf	58%	ReversingLabs	Linux.Backdoor.Mirai
cenSXPimaG.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.30.dr	false	unknown
http://wiki.x.org	syslog.30.dr, Xorg.0.log.149.dr	false	unknown
http://www.ubuntu.com/support)	syslog.30.dr, Xorg.0.log.149.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
83.226.170.160	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
57.255.57.217	unknown	Belgium	2686	ATGS-MMD-ASUS	false
167.126.20.176	unknown	Reserved	2055	LSU-1US	false
66.42.30.81	unknown	United States	23314	ORLANDOTELCOUS	false
193.78.39.187	unknown	Netherlands	702	UUNETUS	false
213.219.194.233	unknown	Russian Federation	12695	DINET-ASRU	false
169.149.192.0	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
57.123.40.78	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
155.42.178.255	unknown	United States	54257	VSC-AS-VERMONT-STATE-COLLEGESUS	false
100.152.103.52	unknown	United States	21928	T-MOBILE-AS21928US	false
23.126.5.248	unknown	United States	7018	ATT-INTERNET4US	false
4.208.156.123	unknown	United States	3356	LEVEL3US	false
156.149.192.211	unknown	New Zealand	137	ASGARRConsortiumGARREU	false
82.93.81.165	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
54.54.60.44	unknown	United States	14618	AMAZON-AESUS	false
158.73.75.5	unknown	United States	19050	TIC-DHHS-INTERIORUS	false
190.112.213.101	unknown	Paraguay	263228	PLANETSAPY	false
192.133.196.244	unknown	United States	109	CISCOSYSTEMSUS	false
119.174.49.185	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
208.88.39.220	unknown	United States	14701	ELEMENTEKUS	false
198.64.19.49	unknown	United States	25977	HCCSUS	false
63.175.249.14	unknown	United States	1239	SPRINTLINKUS	false
54.226.65.127	unknown	United States	14618	AMAZON-AESUS	false
111.39.171.163	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
213.166.86.22	unknown	Netherlands	207083	HOSTSLIM-GLOBAL-NETWORKNL	false
169.232.245.77	unknown	United States	52	UCLAUS	false
134.88.115.43	unknown	United States	394003	UMASSDUS	false
25.124.3.227	unknown	United Kingdom	7922	COMCAST-7922US	false
13.220.139.117	unknown	United States	16509	AMAZON-02US	false
57.234.176.213	unknown	Belgium	2686	ATGS-MMD-ASUS	false
81.244.132.78	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
39.144.167.219	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
199.13.187.38	unknown	United States	1767	ILIGHT-NETUS	false
14.104.146.243	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
101.234.204.123	unknown	Australia	45577	INTERVOLVE-MELBOURNE-AS-APIntervolvePtyLtdAU	false
47.179.91.114	unknown	United States	5650	FRONTIER-FRTRUS	false
120.247.64.105	unknown	China	56048	CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN	false
118.123.151.122	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
139.86.12.192	unknown	Australia	45213	USQNET-AS-APUniversityofSouthernQueenslandAU	false
163.192.26.203	unknown	United States	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
8.76.213.65	unknown	United States	3356	LEVEL3US	false
110.155.6.215	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
222.167.140.6	unknown	Hong Kong	9908	HKCABLE2-HK-APHKCableTVLtdHK	false
157.37.178.101	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
54.29.55.83	unknown	United States	14618	AMAZON-AESUS	false
32.207.10.225	unknown	United States	2686	ATGS-MMD-ASUS	false
100.152.127.205	unknown	United States	21928	T-MOBILE-AS21928US	false
106.31.5.111	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
154.138.186.246	unknown	Egypt	37069	MOBINILEG	false
19.62.209.44	unknown	United States	3	MIT-GATEWAYSUS	false
216.214.158.100	unknown	United States	7029	WINDSTREAMUS	false
221.221.242.129	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
31.134.158.143	unknown	Russian Federation	42668	NEVALINK-ASRU	false
174.114.169.175	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
43.88.113.73	unknown	Japan	4249	LILLY-ASUS	false
184.243.41.193	unknown	United States	10507	SPCSUS	false
195.158.190.56	unknown	Germany	20676	PLUSNETDE	false
143.156.195.138	unknown	United States	497	AFCONC-BLOCK1-ASUS	false
5.232.36.132	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
108.209.29.18	unknown	United States	7018	ATT-INTERNET4US	false
93.133.20.117	unknown	Germany	6805	TDDE-ASN1DE	false
100.157.62.158	unknown	United States	21928	T-MOBILE-AS21928US	false
149.24.164.70	unknown	United States	54624	EL-FAIRFAX-VAUS	false
124.75.165.129	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
207.244.209.5	unknown	United States	6428	CDMUS	false
95.239.15.11	unknown	Italy	3269	ASN-IBSNAZIT	false
38.9.223.35	unknown	United States	174	COGENT-174US	false
144.123.158.240	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
208.52.209.184	unknown	United States	22626	VCI-22626US	false
113.180.48.227	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
217.72.194.4	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
161.240.146.33	unknown	United States	396269	BPL-ASNUS	false
32.173.179.52	unknown	United States	2686	ATGS-MMD-ASUS	false
111.222.155.25	unknown	China	17962	TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN	false
1.227.146.158	unknown	Korea Republic of	9277	SKB-T-AS-KRSKBroadbandCoLtdKR	false
186.227.57.223	unknown	Brazil	53162	VOIPGLOBESERVICOSDECOMMULTIMIDIAVIAINTERNETBR	false
57.160.253.214	unknown	Belgium	2686	ATGS-MMD-ASUS	false
23.43.32.11	unknown	United States	16625	AKAMAI-ASUS	false
108.140.54.16	unknown	United States	16509	AMAZON-02US	false
175.246.117.128	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
133.144.248.189	unknown	Japan	2500	WIDE-BBWIDEProjectJP	false
96.87.29.160	unknown	United States	7922	COMCAST-7922US	false
105.72.143.133	unknown	Morocco	36884	MAROCCONNECTMA	false
76.101.169.195	unknown	United States	7922	COMCAST-7922US	false
175.91.59.169	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
97.94.57.120	unknown	United States	20115	CHARTER-20115US	false
101.213.151.15	unknown	India	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
110.180.4.232	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
169.37.66.43	unknown	Switzerland	37611	AfrihostZA	false
69.174.72.204	unknown	United States	3257	GTT-BACKBONEGTTDE	false
159.246.182.78	unknown	United States	29899	GEISINGERUS	false
97.220.70.212	unknown	United States	6167	CELLCO-PARTUS	false
43.85.133.159	unknown	Japan	4249	LILLY-ASUS	false
139.199.167.77	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
148.129.11.249	unknown	United States	7764	CENSUSBUREAUUS	false
120.129.72.166	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
150.71.200.98	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
17.119.134.106	unknown	United States	714	APPLE-ENGINEERINGUS	false
20.23.44.64	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
51.250.99.224	unknown	United Kingdom	2686	ATGS-MMD-ASUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
57.255.57.217	SecuriteInfo.com.Linux.Siggen.9999.3670.17870.elf	Get hash	malicious	Mirai	Browse
213.166.86.22	home.mpsl	Get hash	malicious	Gafgyt, Mirai	Browse
193.78.39.187	jew.arm7	Get hash	malicious	Mirai	Browse
213.219.194.233	pwFaKVCXrY	Get hash	malicious	Mirai	Browse
119.174.49.185	gWG8IWTQvp.elf	Get hash	malicious	Mirai	Browse
	IDTkPkfSPq	Get hash	malicious	Gafgyt, Mirai	Browse
	aqua.ppc	Get hash	malicious	Mirai	Browse
	arm7	Get hash	malicious	Mirai	Browse
	TDJjjFDkG4	Get hash	malicious	Mirai	Browse
169.232.245.77	UnHAnaAW.x86	Get hash	malicious	Mirai	Browse
57.123.40.78	trynagetmybinsufucker98575.arm7	Get hash	malicious	Mirai	Browse
57.123.40.78	y7Moelc63I	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-mirai.kro.kr	2UngC9fiGa.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	0wG3Y7nLHa.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	XvAqhy3FO6.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	970Qh1XiFt.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELENOR-NEXTELTelenorNorgeASNO	x86.elf	Get hash	malicious	Mirai	Browse	46.156.86.217
	na.elf	Get hash	malicious	Unknown	Browse	148.123.215.141
	2qWIvXORVU.elf	Get hash	malicious	Mirai, Moobot	Browse	157.237.144.216
	na.elf	Get hash	malicious	Mirai	Browse	62.92.203.143
	ZEjcJZcrXc.elf	Get hash	malicious	Mirai	Browse	84.218.165.23
	na.elf	Get hash	malicious	Mirai	Browse	88.89.169.96
	na.elf	Get hash	malicious	Unknown	Browse	146.173.30.162
	na.elf	Get hash	malicious	Mirai	Browse	193.215.192.111
	na.elf	Get hash	malicious	Mirai	Browse	148.119.111.133
	na.elf	Get hash	malicious	Mirai	Browse	88.89.169.50
ATGS-MMD-ASUS	2UngC9fiGa.elf	Get hash	malicious	Mirai, Okiru	Browse	48.131.111.170
	XvAqhy3FO6.elf	Get hash	malicious	Mirai, Okiru	Browse	51.65.109.90
	970Qh1XiFt.elf	Get hash	malicious	Mirai, Okiru	Browse	34.44.37.101
	x86.elf	Get hash	malicious	Mirai	Browse	57.10.146.234
	https://issuu.com/smart_media/docs/die_welt_wirtschaft/19	Get hash	malicious	Unknown	Browse	34.36.216.150
	Portal.msi	Get hash	malicious	Unknown	Browse	34.128.163.126
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	34.187.79.97
	xd.x86.elf	Get hash	malicious	Mirai	Browse	32.37.108.170
	xd.arm.elf	Get hash	malicious	Mirai	Browse	57.4.20.202
	http://patjimmy323.wixsite.com/my-site-1/	Get hash	malicious	HTMLPhisher	Browse	34.144.206.118
ORLANDOTELCOUS	yakov.m68k.elf	Get hash	malicious	Mirai	Browse	199.73.105.200
	.exe	Get hash	malicious	Unknown	Browse	96.47.154.206
	vQPpTr8mfm.elf	Get hash	malicious	Mirai	Browse	208.95.81.175
	QSX0atAPpN.elf	Get hash	malicious	Mirai	Browse	74.85.182.155
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	66.42.30.97
	UGXRHW5XnG.elf	Get hash	malicious	Mirai	Browse	74.85.182.114
	gB4Uoi2RpM.elf	Get hash	malicious	Mirai	Browse	66.42.13.156
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	74.85.182.114
	XXEEnTN5Xb.elf	Get hash	malicious	Mirai, Okiru	Browse	208.95.81.169
	KAkPZUPpZJ.elf	Get hash	malicious	Mirai	Browse	66.42.29.97
LSU-1US	na.elf	Get hash	malicious	Mirai	Browse	167.112.78.162
	yakov.sh4.elf	Get hash	malicious	Mirai	Browse	167.124.147.171
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	167.120.108.3
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	167.126.208.40
	KKveTTgaAAsecNNaaaa.m68k.elf	Get hash	malicious	Unknown	Browse	167.113.93.202
	b3astmode.arm.elf	Get hash	malicious	Mirai	Browse	76.165.240.94
	teste.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	96.125.14.7
	mirai.mpsl.elf	Get hash	malicious	Mirai	Browse	167.112.31.196
	5xUAAMwlnJ.elf	Get hash	malicious	Unknown	Browse	130.39.231.246
	ts2d2a5oFa.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	167.112.13.151

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5701/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5704/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5706/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5708/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5710/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5712/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5717/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5793/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5821/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5824/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5826/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5828/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5830/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5832/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5837/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6023/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6180/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6195/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6259/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:wSvn:wSv
MD5:	4B3757EADBAFB2D6FAC97633A420F2D4
SHA1:	9070D01ED6A42C1DA84F6C156411D98F0292D47C
SHA-256:	4408C21A538B22B616F9319967C2EFFF387433FA8B6E93A84B1924097A8C8499
SHA-512:	DE10A5A9613BC6A5CFD508B0A1FCADA49A4F6527FA06B1D77AE5B759EC212D4D1AF7188D342C06D65D4975B24A152D4CA7E64F81F4C1B386F2BEDD5FFF0E7CEF
Malicious:	false
Preview:	6187.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:GLn:GL
MD5:	7F61A5E06EB8E903A0B8C395155F7F39
SHA1:	781BB21A22F1E50D23D4B9809CEBD0F59BD9A01C
SHA-256:	E108529F26146E01ADEBC3E54551AED0F158BC2A4F0FA79DFE2D13822B814352
SHA-512:	B6912863BE8BF61AC5554B15D27E851722DE93372027D879B1610B0167845C324B3F0F98E1CFF46AD01A7193271286CE3324B3C01414603BFF6F679AF4E247A5
Malicious:	false
Preview:	5662.

/run/systemd/inhibit/.#1npSKxf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifMd1IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfM3ApLHK7wR9n
MD5:	A44A7CE6D1CF20706D578AF066756ED8
SHA1:	6BFBF93EF20CEF53119A5E15D45F7DB8F4DC55A0
SHA-256:	F3C614592AAB5ACA19FBB5DD0FFF7ECB49E0BF1171F7DAE5DA6646DE76A2A5BC
SHA-512:	54D88F4C8D170CD5F8CE76F7F2CDE9BD91A002E7FE4F84CCE94EF3B44463A6E030D551FE25CEB99E7237D42627F84CF1F28475ABA946B62F9DF75C84AF5606FB
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6029.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2lqnKfc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.189098625102878
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+ZqKLXv0Rsz:qgFqXQXTI1IlwqKjcRsz
MD5:	B327B5D54D169211893F0408B8502CA9
SHA1:	CA829245831521F2CBF5E20357A2AA5EAE5BFC33
SHA-256:	544CAAD32EC99CA83A1ED4B9EB35DEA23267A1CDA8AE40B1578265093224804A
SHA-512:	9D311FBF2BB7178828D2E4CB4A9D5AF4BD10104C69FA48EBBF10B5F1B12656A98A58D143E4A7C480F0600835363CE76FED4868F9E4D3D72950801DC16CF58DCA
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6227.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#36HiN9d

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.148187060462055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++83iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+ZqKLXv0RT
MD5:	FB1142FCCC036F83D5C70CFAF4EE9393
SHA1:	B3A9E68F6849B11C2CD1644655CE61D760A93519
SHA-256:	3CEDF766957CE4DB84D0B585A3F0C52C9E56EC77890A3768235FCC622DF23ED6
SHA-512:	4F35A267045BFFAF92895E27C2E13C885002D6391E752153221BA7AF68F1CB8AF99E6C6B26CCF95E30ED8B9D0D799B2A36A8BB6C832616CE7A6FB63A87C91831
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6227.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/seats/.#seat07VH0Jc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0AblHmd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0JZUsid

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0Jt3B2c

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0KEKBAd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0aSlmyd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0u6RhYd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/sessions/.#c12AHdig

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.415214644953121
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBKEJgdCN/QMg:qgFqPumW8IG0n99x2xayWKEJgdCtQf
MD5:	9EFFD9930F0E7E5E8E72EA06A9290242
SHA1:	428FDAE9A3740388C1165A88826D77AE96530682
SHA-256:	B41E12C8E38DB8A3A3CAE1C53983D45A6FA369E250C30C024E43BFF03C468567
SHA-512:	8EB750394DB893AE36E4CF1067B18D5D0E109DCAA71D2E71AF83508BDAC79D7C8BE1BE6EFC4EFF703B702C0757811F3C6B371804BBA1BD03C4B591F81DDB214D
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5685.REALTIME=1728322749624521.MONOTONIC=151021252.

/run/systemd/sessions/.#c14Ja1Rd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.470016112057164
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedVuRmUKBhcIS3xffCuxfx2xNIByy6GBKEJgdCN/QMg:qgFqPumVuRZI4B19x2xayWKEJgdCtQf
MD5:	B196D2109532DBF213221544A80B0A3F
SHA1:	357F1A15175C1B13CDEF46E4DF67EC2B54CDB2B3
SHA-256:	C04F091BE1B26B47258F689A06146F8073D1FED58D289AD1744B93ADA5F4454F
SHA-512:	85DC95CA2C1A6912827B73970029AB630C886299C8B910FBEA6CCECD6BFA5518DC906FC53159BC9DB96A57EF9CE412D7C2A4D7B3200F1B90D9404F784999D124
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7811.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5685.REALTIME=1728322749624521.MONOTONIC=151021252.

/run/systemd/sessions/.#c19GRI6f

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.426101887798995
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKEJgdCN/QMQ33:qgFqPuFN6IG0n99x2xayWKEJgdCtQX33
MD5:	4BA9D3E9DE4A19A7CDF6D91DBE4518AE
SHA1:	D8813421AE6656B0F19A72F964F03EB6A76601E2
SHA-256:	A2AB2AEEC5CA444017B75DBEFA172EBAA86FC8E00CAEF8FA4A225826D9986025
SHA-512:	7C4AC641E461044D97B23F18E17E9563E82A49F5A17EF426723BF0A9B6BF0A4FE7BA8D4BA9AB1031408991CB086D603CA5C0DD261A4FB8E0183E1165D0E6A7D8
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5685.REALTIME=1728322749624521.MONOTONIC=151021252.CONTROLLER=:1.13.

/run/systemd/sessions/.#c1GGbOZc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.415214644953121
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBKEJgdCN/QMg:qgFqPumW8IG0n99x2xayWKEJgdCtQf
MD5:	9EFFD9930F0E7E5E8E72EA06A9290242
SHA1:	428FDAE9A3740388C1165A88826D77AE96530682
SHA-256:	B41E12C8E38DB8A3A3CAE1C53983D45A6FA369E250C30C024E43BFF03C468567
SHA-512:	8EB750394DB893AE36E4CF1067B18D5D0E109DCAA71D2E71AF83508BDAC79D7C8BE1BE6EFC4EFF703B702C0757811F3C6B371804BBA1BD03C4B591F81DDB214D
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5685.REALTIME=1728322749624521.MONOTONIC=151021252.

/run/systemd/sessions/.#c1HfuY7c

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.368690662043256
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBKEJgdCN/QMg:qgFqPuFdDJIi9x2xayWKEJgdCtQf
MD5:	84BE56FC4D762C6BF83425341135D37D
SHA1:	AE9BF605BC61107637D8B16197F6969B32326393
SHA-256:	EED101F85E7EDB79882C523BB41717FD2CA3327C0BDA882CDBF77EABDDA0FDDD
SHA-512:	DD12BF3533ADC460C006BAC8EDF223F094251CE646C2CA2253CC2A5110AC446091A3F1EC4F25A647039F0AFEA983624D61B08EECE6AF2806F8291A09677105C5
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5685.REALTIME=1728322749624521.MONOTONIC=151021252.

/run/systemd/sessions/.#c1ZAsZ7b

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.412606222166818
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKEJgdCN/QMg:qgFqPuFN6IG0n99x2xayWKEJgdCtQf
MD5:	085F251FEA2689C9B29C262A3D0D1CC9
SHA1:	0544183679ACC31F837ACC39B2338F5148D36351
SHA-256:	02D5CE388EA7B5E61541C51A8880795A6BC1A8CA9B658BE90CBF9D256B910880
SHA-512:	75B62D3607005A29A57556D30C5375E009D3319E2CDCD98DE152C415FD5DDFE01B6D3A660A61E9A0471A8D87C55FDCF40BBC5931DDA2AFC13A0BCB066AEB6778
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5685.REALTIME=1728322749624521.MONOTONIC=151021252.

/run/systemd/sessions/.#c1xTrlRb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.412606222166818
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKEJgdCN/QMg:qgFqPuFN6IG0n99x2xayWKEJgdCtQf
MD5:	085F251FEA2689C9B29C262A3D0D1CC9
SHA1:	0544183679ACC31F837ACC39B2338F5148D36351
SHA-256:	02D5CE388EA7B5E61541C51A8880795A6BC1A8CA9B658BE90CBF9D256B910880
SHA-512:	75B62D3607005A29A57556D30C5375E009D3319E2CDCD98DE152C415FD5DDFE01B6D3A660A61E9A0471A8D87C55FDCF40BBC5931DDA2AFC13A0BCB066AEB6778
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5685.REALTIME=1728322749624521.MONOTONIC=151021252.

/run/systemd/sessions/.#c22QbOLf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.410644670264955
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBlcQ0JgdAR/ej:qgFqPuFNuCH0nI9x2xayWlEJgd0/u
MD5:	801AA3DAD4C2C112536CBBADF8D442C8
SHA1:	5421AAF5B17D5F8FFAF2A64668F24CDEE8EDBCDF
SHA-256:	989D0FC82853B8B08E78EEACD7ABF80173A28A7AAC07285A6348CA9701966C92
SHA-512:	C923B527883083413394B2AFEEB9A8E2292379748D6306218BC9CD7C781C3A6F2ED1D1B2F3A9DF39CA344973F4291FD94C9982633FE3CDFC6C9135F3CD020F07
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5747.REALTIME=1728322764778005.MONOTONIC=166174736.

/run/systemd/sessions/.#c2ALw2Zb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.439617609958603
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBlcQ0JgdAR/ehlYs:qgFqPuFNuCH0nI9x2xayWlEJgd0/ElYs
MD5:	786940A3DE9D4B017DD16B07511D2492
SHA1:	CF7D4A9FFB97BDD55B1762B8BC76500712992A8D
SHA-256:	73C3FFBA745F441B920BE6DF65E2FBDBD31234644BECAA85A725F198D3307CD2
SHA-512:	A1883C4C7BB2206B297051DE1EB1637C77EB09B686C33B43BAFDC5DD27920FE9D676C90A4F4C1F4C9DBEE27468209607925DFBC592A75723972B39EDA5EC167A
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5747.REALTIME=1728322764778005.MONOTONIC=166174736.CONTROLLER=:1.17.DEVICES=13:64 13:66 13:65 13:67 .

/run/systemd/sessions/.#c2Qr8PPc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.416897521479052
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBlcQ0JgdAR/ehlL:qgFqPuFNuCH0nI9x2xayWlEJgd0/ElL
MD5:	1BA9B88A8381D72C78C2DE006D29D8CF
SHA1:	4D96BA22A2F314D8444502746497BCEBD525C768
SHA-256:	766C3F91010DA8EE755976C6E2AFD6D1A8C64B7C3864BA5B69D4476FCC65DCE1
SHA-512:	48BEE9EED3D1FBB5EB4A38F784E6B9FFA32526BC1E4BC3BF7AC11B6B6763235CCBFA1CD6580C3A5FF7A35850F5A69635AB5F828D1F04AACD7D052C921C97F2F0
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5747.REALTIME=1728322764778005.MONOTONIC=166174736.CONTROLLER=:1.17.

/run/systemd/sessions/.#c2hHUmMf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.422598287539078
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBlcQ0JgdAR/ehlV:qgFqPuFNuCH0nI9x2xayWlEJgd0/ElV
MD5:	A0216627C7836BDDB65853B5A477A61D
SHA1:	5483334583CC70207E84E02666CF69E69818DDC0
SHA-256:	58DB329E4808DAC57B2BCF27CEA0F36ACE323FBD81C266D9261424B09B6E213B
SHA-512:	B65FC2304E9B00D3D35B0BEBD8A5F93658D72D325B40B5A84CB28DF6D4F20BA93FF9AC0E3FCC955945EB9E86BBFAD5A0C22ED5A1614D755FF6244C1DC633380F
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5747.REALTIME=1728322764778005.MONOTONIC=166174736.CONTROLLER=:1.17.DEVICES=13:64 .

/run/systemd/sessions/.#c2oHK34c

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.438381014549945
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBlcQ0JgdAR/ehlCs:qgFqPuFNuCH0nI9x2xayWlEJgd0/ElCs
MD5:	C48B3E81A81EAE237C21734FC951F27B
SHA1:	DA4D8C1B4E77B24C2FCA1DCEDFC8B829623BBEE9
SHA-256:	1F747C6BB5F67BB7F3B80785971E397E00D6F120F51EBB9ACDD11DF9646F69D7
SHA-512:	E0FC6EE3BB73D6A4C2A96C561B00BE2AAC0D27F003FAAEE23192353DF3FCAB181144CD4D7004AF699624806B9C88EF9C3E7E61315E577553D6A1A4F840837E9D
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5747.REALTIME=1728322764778005.MONOTONIC=166174736.CONTROLLER=:1.17.DEVICES=13:64 13:65 13:67 .

/run/systemd/sessions/.#c2snNt1b

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.435261571535605
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBlcQ0JgdAR/ehl23:qgFqPuFNuCH0nI9x2xayWlEJgd0/El23
MD5:	7CD473E24A629D42A36BFB9575640B20
SHA1:	F2B177204CD9F57319C4B56761A5B1F796CFFEB4
SHA-256:	7D386A360E901EE654E5C930C30697EBBA4E6432E3828BB587605579D8F0059E
SHA-512:	E814174E4A4E254952AB1CC53A60FDB5534F0A045424DD265F9972511E21169053202662A11115B0724A67E4AFA5F22B5C59B08C9DADF50A52028C7AF0FA6C3D
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5747.REALTIME=1728322764778005.MONOTONIC=166174736.CONTROLLER=:1.17.DEVICES=13:65 13:64 .

/run/systemd/sessions/.#c2t6Ihfg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.461555027299714
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffC3xfx2xNIByy6GBlcQ0JgdAR/ej:qgFqPuFVuRpCvBM9x2xayWlEJgd0/u
MD5:	A249B6633DF9417A5C839EA453B9A2DD
SHA1:	BA2BED9D5EC9578E39E0252C0AED123D44383B86
SHA-256:	EBD9493E61AFF792626ACF2FA2450DF271CD8138BC2355F3CE5778EAC1C2B3FB
SHA-512:	EB3302A44E48A5E47945EE9E18BD5F052E3B105B164A3DB7EAA4950CF60A250E58328812485B3717512FF8901BBD8C1D69EC10CF03F3EC3420E0448E43D4FE22
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7874.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5747.REALTIME=1728322764778005.MONOTONIC=166174736.

/run/systemd/sessions/.#c2yYwfnf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.410644670264955
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBlcQ0JgdAR/ej:qgFqPuFNuCH0nI9x2xayWlEJgd0/u
MD5:	801AA3DAD4C2C112536CBBADF8D442C8
SHA1:	5421AAF5B17D5F8FFAF2A64668F24CDEE8EDBCDF
SHA-256:	989D0FC82853B8B08E78EEACD7ABF80173A28A7AAC07285A6348CA9701966C92
SHA-512:	C923B527883083413394B2AFEEB9A8E2292379748D6306218BC9CD7C781C3A6F2ED1D1B2F3A9DF39CA344973F4291FD94C9982633FE3CDFC6C9135F3CD020F07
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5747.REALTIME=1728322764778005.MONOTONIC=166174736.

/run/systemd/users/.#1271ZKlYd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.16070974769323
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgdCxdRaM02thQc2x9sS02/g2owB:qgFq30NzL/ixegdCJthQHxbPYA
MD5:	9C35C37C00343008DC40788C94CF41AF
SHA1:	5D6E88B01FF9223C9CED607144BD0174817AD3B6
SHA-256:	72B279A6586906A19C8ECB96DA4F38ED09EEF5B69C1FC6EBBDA8D900FDCB5C2F
SHA-512:	9F56A1D88B2A37FBD7932BEAF76E612C3404C97C2F3E09BE918EC86F0014B20C05BC83B5E0AC8EADC9D8136721AB69BEFF90809683904DEF1EE9D59B13487254
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1272lIIef

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.1554447321509125
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgdCxdRaM02z5c2zw02zb2owB:qgFq30z1cL/iRJgdCJz5HzwPzbA
MD5:	26A46ED18E34FF93A1D61EEB69840415
SHA1:	C5F47B3609DB1DD062A83073B665C28BCAA1896A
SHA-256:	CC59E503F99918D8EA803D800F1B1EBAF6A28F06505A77F93E51A6481E1487F1
SHA-512:	BE09E825784287FBE47666F5E8829E7A5B80446DC3DA296FB01351CA1EB578F09F860FF865DC81EF2897BBCE694CEE265C84B355B364AD524716663EA8E392C0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127AJG2qe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127EcKExd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.168819231652662
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgdCxdRaM02thQc2pb02nmD2p9rwC:qgFq30dAL/ixegdCJthQHtPnmDq9x
MD5:	9C438002BB101BD8946C0110952D652D
SHA1:	A09E8A33D0DA7C4B97801E237F0C107A7B73E4DC
SHA-256:	D2EDD4D6A12FBFCE444E9A3574FE6C5443DA010A83CD252BD6453470B2C0FEE9
SHA-512:	BE605F8E1BB1B93F6879E119B337207427FD8A055DDFBD421771EBDDE8445F0E583DCA40243DA9347DFF29595A16F9B5C92F08BDF13FD648E4421D56A06A60FF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127Kruwaf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.305958303653127
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffs7gdCxdRaM02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBAgdCJthQHtPYq9M
MD5:	924159D50DF7DABC678E21A7AA326646
SHA1:	625619F3F7EDBE2AD52F1BDFF6A9368856E24955
SHA-256:	30CDDFE84A2E201CC3320DBCDEA05E957D1EC94352498AB3071BB5ED4A6261C9
SHA-512:	DAF2527C5CC9AE4B68DC76EA19F7D3390CF02426C065E503DBA16A8FF33D0F9EE765E454CC2B607D16E552D3E8A046E892C581705A8912328037C5765B6697B7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7749.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127OQKXJf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.170660759706268
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgdCxdRaM02thQc2pb02/g2p9rwB:qgFq30z1cL/ixegdCJthQHtPYq9M
MD5:	A0D27724EAA9D4474AF11CE75998483A
SHA1:	EE69372DA41381D4C76C13C4CF60641B4CCC26ED
SHA-256:	8D384F1BE004EF0A90401F606E242F69A1358E2DB63352925D1179EEC751A182
SHA-512:	BB27836DF9220001F790EC7BF9CF70C288C6D8888A369F56CA425FAC0A631D46C07BFFC29B0AEBCB8E19834BC874308C8B504E2B05DE6E131D426D84E83DECE4
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Y6wzEf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.17664600267331
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgdCxdRaM02z5c2zw02zb2owB:qgFq30z1cL/ixxTgdCJz5HzwPzbA
MD5:	1F0E51332996397E4931302035CA282A
SHA1:	10019BEA7AF8B858E96F6BD6868138ACA409707B
SHA-256:	AF82F24500FA866200C8185BEF8F58492BE69005B634DD3F797BAB72A55F8166
SHA-512:	FC4C3EB6F3248CEF8240BC5F4CC9C9BB4B71E94F6FFEA5D9004E8EAAE31E3F072446AF43E9CD0C6FB61D257E7BBAB1FBE6B1C3903EF5327D101CE86437F20946
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127cl5MGd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.170660759706268
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgdCxdRaM02thQc2pb02/g2p9rwB:qgFq30z1cL/ixegdCJthQHtPYq9M
MD5:	A0D27724EAA9D4474AF11CE75998483A
SHA1:	EE69372DA41381D4C76C13C4CF60641B4CCC26ED
SHA-256:	8D384F1BE004EF0A90401F606E242F69A1358E2DB63352925D1179EEC751A182
SHA-512:	BB27836DF9220001F790EC7BF9CF70C288C6D8888A369F56CA425FAC0A631D46C07BFFC29B0AEBCB8E19834BC874308C8B504E2B05DE6E131D426D84E83DECE4
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127l0scEc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.180165563734815
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgdCxdRaM02thQc2x9sS02nmD2owC:qgFq30dAL/ixegdCJthQHxbPnmDd
MD5:	19E4447298E9B6733DD31E56C9E99D67
SHA1:	FF8B7B7848D848EAF3B417709F408D0E15C511AE
SHA-256:	64A60511EDFA979DE5EFEC8A1B554C5672689354B840DF05B482213C2C8346E4
SHA-512:	5FF884B6E1407AFE9157F0E81971A66805FBFD4355D4785B8C82DD8C0F72A26017CB31D392DD5D93AC8087EDF440C33C5A2D1D2DC0DCEEA221751FF3780E64E1
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127ndjdxe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.16070974769323
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgdCxdRaM02z5c2zw02zb2owB:qgFq30NzL/ixxTgdCJz5HzwPzbA
MD5:	2430ABC2EB8E23325DEA5F0D91D03646
SHA1:	3788D398275DF4B1AF375F3B36AB7EB7DB4DDB34
SHA-256:	2D1FB6336F99D94E2B7661957801CE3F2FB4FE52758959EE8AA8443228BF2106
SHA-512:	E567458EE3D71BB60821A0B2DB96C813E216E0694E4D0E1B8982F5847B6CFB961B03CF6B4CDFD688CB1A3B6970B3D336DCA20C3A7B8FD6DB33D7376E3FAD5120
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127qwtE8d

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.327205108971
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6ufgdCxdRaM02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBi6gdCJthQHtPYq9M
MD5:	79172EB8E5F1BF466F72CBE311E66587
SHA1:	0F94A8746FAD53EA5C3AEA1169D39DFE32E86665
SHA-256:	55595E5BDB50D7132C2C6B0DD58D30BE41F8A75BD336BB311774E9FCDC142AF5
SHA-512:	BCB1AF78BF420E1989AD55CD8405188C1196DE1826B3E652AAFFCE547FE0BBAFA45B856DBF6AB03E872F87E8D036DF51F176D2CE1D298E93BC148EEB1E059F32
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7749.DISPLAY=c1.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127zzHvNe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.168819231652662
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgdCxdRaM02thQc2pb02nmD2p9rwC:qgFq30dAL/ixegdCJthQHtPnmDq9x
MD5:	9C438002BB101BD8946C0110952D652D
SHA1:	A09E8A33D0DA7C4B97801E237F0C107A7B73E4DC
SHA-256:	D2EDD4D6A12FBFCE444E9A3574FE6C5443DA010A83CD252BD6453470B2C0FEE9
SHA-512:	BE605F8E1BB1B93F6879E119B337207427FD8A055DDFBD421771EBDDE8445F0E583DCA40243DA9347DFF29595A16F9B5C92F08BDF13FD648E4421D56A06A60FF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322749603844.MONOTONIC=151000575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:It:It
MD5:	EEE69F78E0109C0BDE71BB56388702D2
SHA1:	3BAFB3AED6B3591D64AFE1640F75529280A9F77D
SHA-256:	C264A73FA01FB245E5DFC514FD3B891DCC9F5E91926529AC7CF7DEAA2FEDC449
SHA-512:	3347933BB28808C54C6FEAECB1F977B571C2D467D9DEA090FE91E1E0958A23F77B88DA33531B58D2873097CE9DF961AFA65176EFD65FFDC6E457F432CA9A8EBD
Malicious:	false
Preview:	5864.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.977274559044664
Encrypted:	false
SSDEEP:	12:OxPpYRveY+pYFn1JxPHuYEDveY+HuYUxPDQXwveY+D44xPUBKiveY+U3BQZ0veYB:CZOLXIr86BPav1k+1rHELtH
MD5:	19EE6B4A92F5B55DDF02540B072DCD05
SHA1:	B1D60CB5BE817A73636E66F97BB9D476C19C96C4
SHA-256:	65EB5828AE1F88AF13EB8AD9620F322A277D21FE037D1096D89EAF1CBAFC07E6
SHA-512:	A17C4FF4762AF6D1E081883C2111786652845999BC5D77C710D1F107A2A450B50B27548CF30CAB172F591D91F93E4A3F2ADE70578D183DD884F296C1AC7A3EA8
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5777..MIT-MAGIC-COOKIE-1....d..m.......=..XSMP...#local/galassia:@/tmp/.ICE-unix/5777..MIT-MAGIC-COOKIE-1...z.".0..\.j8..P...ICE...!unix/galassia:/tmp/.ICE-unix/5697..MIT-MAGIC-COOKIE-1......S.E}$.ab......ICE...#local/galassia:@/tmp/.ICE-unix/5697..MIT-MAGIC-COOKIE-1..._...S-\|v.j.ZqI...XSMP...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1.....w.0......F!W...XSMP...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1......,mN..b7.....ICE...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....]v1..".?.}.....ICE...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1...o4...6]..c..f....XSMP...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1..N.#r......S.....XSMP...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....q.p.."LS.DM(..ICE...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...]...,0..2...`..ICE...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...y.&.O...j../I....XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.983294787198872
Encrypted:	false
SSDEEP:	3:rg/WFllasO93lE8z3dPCWFllasO93lE8z3dPE:rg/WFl2VE8LdKWFl2VE8Ldc
MD5:	7B9F431A4B2C60BA12A60579BBB48E61
SHA1:	6087661029184759EBEB5A31AA61154B6A2BAA91
SHA-256:	A8509EFEA81E3A116618895E4A89DE0B89140F64BE162FE1C3315C76BAFA36EB
SHA-512:	52883F1B1A99EE56182CA5513AA2B20014EA5CF8D83C5C0DE9132AB37B90C2164299A5E45CEBD1A940D962AD0A3E93F09494B1176DC0922F3EACBCAF052DC462
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1...[.Y.\|..y8G..`.....galassia....MIT-MAGIC-COOKIE-1...[.Y.\|..y8G..`.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:q:q
MD5:	C0599731DFC6B30CE3398FB7D2922C36
SHA1:	4CFAD854ABC3177A67E12DCC3A951169C74C7235
SHA-256:	D234D642819C661A856F16C1B1DE069E8BD3996A9A55111827C765FD915B3078
SHA-512:	CC40149D1B96A2B10E472ACF059A6E5A7793F5BA5E06192281B39C924DB2B449871DBD1F7155D842BF8BF34A0DDC6C0EEE832A4991668400619277B6F75CEE82
Malicious:	false
Preview:	6067.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:ACsXlXEWtl/Mtll/:Af+yl09
MD5:	76F306375D5A57BEA2046C71DD8D6EBE
SHA1:	837EEF35917DD361F856558EB6581A8ECA48C3FF
SHA-256:	7EEF2D1C73D991CC55C78DC16EC5446F5C59E7C434A2459568F472057453B736
SHA-512:	13E7153458B5633541EE7EAC413B333E33471FAF6D6E4118F0E1ED0D3946BED214944CAE8AD058682F69523BE504A702A8EC36DE23E15144630C0CDB4718C8D5
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g.+......................................

/tmp/qemu-open.BL1ue1 (deleted)

Download File

Process:	/tmp/cenSXPimaG.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgXL2adJ5n:TgbNdJ5
MD5:	BE9EB23FFF8A714CCA091AB8EFE7B76C
SHA1:	E6ABD8A212711DFAB48152DCAE7018572E1FC1AE
SHA-256:	0E7B9375F2F97852E592CC78966AB898B046745BC74B085884A412E749944108
SHA-512:	93B5CC0B6F6D05BE1F610940EB17A1551FBAAE17FD7297DB1BE120B0C4E14CE3220FAF057A61547A9A013C2930DEA6B3775086702537E33DE86E56D24D2E1DD4
Malicious:	false
Preview:	/tmp/cenSXPimaG.elf.

/tmp/qemu-open.qWCuUx (deleted)

Download File

Process:	/tmp/cenSXPimaG.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgXL2adJ5n:TgbNdJ5
MD5:	BE9EB23FFF8A714CCA091AB8EFE7B76C
SHA1:	E6ABD8A212711DFAB48152DCAE7018572E1FC1AE
SHA-256:	0E7B9375F2F97852E592CC78966AB898B046745BC74B085884A412E749944108
SHA-512:	93B5CC0B6F6D05BE1F610940EB17A1551FBAAE17FD7297DB1BE120B0C4E14CE3220FAF057A61547A9A013C2930DEA6B3775086702537E33DE86E56D24D2E1DD4
Malicious:	false
Preview:	/tmp/cenSXPimaG.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.FHZAV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.195567447292482
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWN34S1419O:q5sU3LWfLUDmQymqSFbfomSfP14fO
MD5:	0566F2A8E9EFFEB7B2D03EE928EF118C
SHA1:	CDC58E9886145D51952E30491E8A8D524A24002A
SHA-256:	D55C68EDFFEBD6FC8DBB967E0CA8A82A5160A2038B033F6020474D0E254BE4D8
SHA-512:	9B8BA345CA52A2A17BB4FC031A8D0F52DED71F0D3E0347C3139295E2EA52618A2A3B1992F28D84A5A76753DACBC2D61EE1BCE8880E4DB70085F3D70CA170DDAD
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-fXkgQOQ8,guid=fa915f099f1185537067b14c67041d01.IBUS_DAEMON_PID=6012.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.286840484847183
Encrypted:	false
SSDEEP:	384:JltL18P+BoTCLZMcdSdNdbdEdud1djdQdKdedzdGdSdGdCdgdjdSdjdhdXfdvad6:XtL2P0ieJRe78Fq+ddmREM+
MD5:	202889334EB595FD0016DB2C70343D7C
SHA1:	73B4B1CB34649D74BEECB9BE2530420C5B9829E5
SHA-256:	BEA6D4D5FC2B2CDB61A0FEDF73290FB13EF170826CF8079E22C34609CB09CF60
SHA-512:	8C461E53F284F3CDD38C6098F77AB0E8312EE92CE7DDD83840E9944BB3EF628982FE98401D4A94D6F58FB5A9D7164D0F1B353F69985810685F8F95E249C3CDD5
Malicious:	false
Preview:	[ 167.977] (--) Log file renamed from "/var/log/Xorg.pid-5754.log" to "/var/log/Xorg.0.log".[ 168.025] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 168.108] Build Operating System: linux Ubuntu.[ 168.144] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 168.159] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 168.200] Build Date: 06 July 2021 10:17:51AM.[ 168.288] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 168.329] Current version of pixman: 0.38.4.[ 168.377] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 168.398] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2435
Entropy (8bit):	5.002938780310245
Encrypted:	false
SSDEEP:	48:Cx1lGvXfVVDrCB6KF/aH0eVDrCb7Drbon:Cx2vXfI2P
MD5:	0914A8A10DEB598D93DE8D284CD2EDE3
SHA1:	D95474AB978DF77EBFBF83C387BF47C2EE48771E
SHA-256:	0583FC4D4F3B64D705A71A38C4A923A021EDF328FCE24971A405EE8153BA7A6F
SHA-512:	2D39055CA1C54D21DB753F0949E3EE0DC307C80A636D2C96B2046B41DB9C9AB748408CB84FD8D6D0B31703B9A5637698822989B5F67F0319E324DD9EAC0B721C
Malicious:	false
Preview:	Oct 7 12:38:41 galassia systemd-logind[801]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Oct 7 12:38:41 galassia systemd-logind[801]: Session c2 logged out. Waiting for processes to exit..Oct 7 12:38:45 galassia systemd-logind[5568]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 7 12:38:45 galassia systemd-logind[5568]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 7 12:38:45 galassia systemd-logind[5568]: User enumeration failed: Invalid argument.Oct 7 12:38:45 galassia systemd-logind[5568]: User of session c2 not known..Oct 7 12:38:45 galassia systemd-logind[5568]: User of session 2 not known..Oct 7 12:38:45 galassia systemd-logind[5568]: Session enumeration failed: No such file or directory.Oct 7 12:38:45 galassia systemd-logind[5568]: Watching system buttons on /dev/input/event0 (Power Button).Oct 7 12:38:45 galassia systemd-logind[5568]: Watching system buttons on /dev/input/event1 (AT Transl

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	38755
Entropy (8bit):	4.730084484031247
Encrypted:	false
SSDEEP:	768:rpjThcWXa+0GpLuT7W787IttZaJHKbyN8glmlilslilolDlGl5Y3g/PjI:VIJHKbyNWg/bI
MD5:	807489B6A56BDDB7F12B7172422B28CA
SHA1:	4371D187A645CE8F833AD2701BE3564F63785C48
SHA-256:	35305D3B42DD07BDB95D2923A38EB5AA5AB6A6DA8E7C5C0A0609447B7ACD9F7B
SHA-512:	E8FCD2E0CB16B995B4BDB3BA208DB13823FB80E0798BEAE2D11F060EEF006314AF53E36A7D0E4363E19AADCFC29B3911EA818ED6C6D4D45B61CDD651D2C7B1A0
Malicious:	false
Preview:	Oct 7 12:38:43 galassia kernel: [ 123.170073] MD5 calculation failed.Oct 7 12:38:43 galassia kernel: [ 123.332700] blocking signal 9: 5499 -> 940.Oct 7 12:38:43 galassia kernel: [ 123.333105] blocking signal 9: 5493 -> 940.Oct 7 12:38:43 galassia kernel: [ 123.563140] blocking signal 9: 5493 -> 1289.Oct 7 12:38:43 galassia kernel: [ 123.564305] blocking signal 9: 5499 -> 1289.Oct 7 12:38:43 galassia kernel: [ 123.809005] blocking signal 9: 5493 -> 1589.Oct 7 12:38:43 galassia kernel: [ 123.812318] blocking signal 9: 5499 -> 1589.Oct 7 12:38:43 galassia kernel: [ 123.974396] blocking signal 9: 5493 -> 3094.Oct 7 12:38:43 galassia kernel: [ 123.976133] blocking signal 9: 5499 -> 3094.Oct 7 12:38:43 galassia kernel: [ 124.060247] blocking signal 9: 5493 -> 3157.Oct 7 12:38:43 galassia kernel: [ 124.063426] blocking signal 9: 5499 -> 3157.Oct 7 12:38:43 galassia kernel: [ 124.635595] New task spawned: old: (tgid 5554, tid 5554), new (tgid: 5554, tid: 5560).Oct 7 12

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	145396
Entropy (8bit):	5.220096290784982
Encrypted:	false
SSDEEP:	768:iFkIu1EThcWFa80GpLuT7W7y7BLdXhqCpQr+mGtJHwWKbm30Jcy+jod/U0lmlilD:ZRzQFaJHwWKbm30Jcy+jod/tVuhHmJ
MD5:	1FEC4CF83CA0D81BDCF23BA3CE4D67D2
SHA1:	49B82D4CB94EC42B820EFD497A102BF702B2570B
SHA-256:	C272B7C2D7E54DC4266B5E858ABD49418127B90779D0B5E1920CF1E217061B6B
SHA-512:	1820890D59B14C870E9FC9E103E6611A6DD7301F44300F87204E6C80D3B65BD34A713A83DF8E3BF84F528A307DE2990DA7BCB2D6447C017A9D5F043A5DDA15DE
Malicious:	false
Preview:	Oct 7 12:38:41 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 7 12:38:41 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 7 12:38:41 galassia systemd[1]: session-c2.scope: Succeeded..Oct 7 12:38:41 galassia systemd[2955]: pulseaudio.service: Scheduled restart job, restart counter is at 1..Oct 7 12:38:41 galassia systemd[2955]: Stopped Sound Service..Oct 7 12:38:41 galassia systemd[2955]: Starting Sound Service....Oct 7 12:38:41 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Oct 7 12:38:41 galassia systemd[1]: Stopped System Logging Service..Oct 7 12:38:41 galassia systemd[1]: Starting System Logging Service....Oct 7 12:38:42 galassia systemd[1299]: dbus.service: Main process exited, code=killed, status=9/KILL.Oct 7 12:38:42 galassia systemd[1299]: dbus.service: Failed with result 'signal'..Oct 7 12:38:42 galassia gdm3: Child process -1369 was already dead..Oct 7 12:38:42

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:ACsXlXEWtl/Mtll/:Af+yl09
MD5:	76F306375D5A57BEA2046C71DD8D6EBE
SHA1:	837EEF35917DD361F856558EB6581A8ECA48C3FF
SHA-256:	7EEF2D1C73D991CC55C78DC16EC5446F5C59E7C434A2459568F472057453B736
SHA-512:	13E7153458B5633541EE7EAC413B333E33471FAF6D6E4118F0E1ED0D3946BED214944CAE8AD058682F69523BE504A702A8EC36DE23E15144630C0CDB4718C8D5
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g.+......................................

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.07983239939122
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	cenSXPimaG.elf
File size:	67'024 bytes
MD5:	6852b0e84e22d0dbaa82ad63136ceddb
SHA1:	2d60977be464c521872bc5c9c6560d95fb42d37b
SHA256:	ce2b7129023bb0aff9b29fb0bce30474f2aa655aa7c16d3c2ef8365a6e3f6c85
SHA512:	07d3c233a395cb6a47e1cb2eb98e118a99c1afdfc00cd61102cd82b6df2091a45e3bd3074c8b581a4835aa89275397a6e10902124e81300df4fb63e736f5f6a7
SSDEEP:	1536:rHCGU0IGC9PHjpCsoqPtinTsaOGs5/lP1TEbjJ:rHCd04jpC+QsaiNlJ2
TLSH:	A3633B91BC815612C6D062BBFB6E428D332A53A8D1EF32179D257F5137C692F0E7B602
File Content Preview:	.ELF...a..........(.........4...@.......4. ...(.........................................................\|&..........Q.td..................................-...L."....:..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	66624
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xe87c	0x0	0x6	AX	16
.fini	PROGBITS	0x1692c	0xe92c	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x16940	0xe940	0x15bc	0x0	0x2	A	4
.ctors	PROGBITS	0x18000	0x10000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x18008	0x10008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x18014	0x10014	0x3ec	0x0	0x3	WA	4
.bss	NOBITS	0x18400	0x10400	0x227c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x10400	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xfefc	0xfefc	6.1314	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x10000	0x18000	0x18000	0x400	0x267c	2.5236	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 19:38:38.668914080 CEST	192.168.2.14	8.8.8.8	0xb441	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:38:39.406877041 CEST	192.168.2.14	8.8.8.8	0xe27	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:38:40.309015989 CEST	192.168.2.14	8.8.8.8	0x69b0	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 19:38:38.678150892 CEST	8.8.8.8	192.168.2.14	0xb441	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:38:39.649550915 CEST	8.8.8.8	192.168.2.14	0xe27	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:38:40.316184044 CEST	8.8.8.8	192.168.2.14	0x69b0	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false

Start time (UTC):	17:38:37
Start date (UTC):	07/10/2024
Path:	/tmp/cenSXPimaG.elf
Arguments:	/tmp/cenSXPimaG.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	17:38:41
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:38:42
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:38:44
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:38:45
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:38:46
Start date (UTC):	07/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:38:47
Start date (UTC):	07/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:38:48
Start date (UTC):	07/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:38:49
Start date (UTC):	07/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:38:50
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:38:52
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:38:54
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:39:04
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:39:07
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report cenSXPimaG.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5701/oom_score_adj

/proc/5704/oom_score_adj

/proc/5706/oom_score_adj

/proc/5708/oom_score_adj

/proc/5710/oom_score_adj

/proc/5712/oom_score_adj

/proc/5717/oom_score_adj

/proc/5793/oom_score_adj

/proc/5821/oom_score_adj

/proc/5824/oom_score_adj

/proc/5826/oom_score_adj

/proc/5828/oom_score_adj

/proc/5830/oom_score_adj

/proc/5832/oom_score_adj

/proc/5837/oom_score_adj

/proc/6023/oom_score_adj

/proc/6180/oom_score_adj

/proc/6195/oom_score_adj

/proc/6259/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1npSKxf

/run/systemd/inhibit/.#2lqnKfc

/run/systemd/inhibit/.#36HiN9d

/run/systemd/seats/.#seat07VH0Jc

/run/systemd/seats/.#seat0AblHmd

Linux Analysis Report
cenSXPimaG.elf

Start time (UTC):	17:39:10
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	17:39:11
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	17:39:12
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --nofork --print-address 4 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:39:14
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:39:15
Start date (UTC):	07/10/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Start time (UTC):	17:39:16
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:39:17
Start date (UTC):	07/10/2024
Path:	/usr/bin/gnome-shell
Arguments:	/usr/bin/gnome-shell
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

Start time (UTC):	17:39:22
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:39:25
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	17:39:41
Start date (UTC):	07/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8