Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1533465
MD5:	69ab287c2939c64aa4072b0588a352f3
SHA1:	0f66b046a5043506e09a22455f08abf00d1b786f
SHA256:	e99e50a2be865c6418ccadfb91ec6e5fe04557ddb29e6e4c18a2c8af307a807b
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Contains symbols with names commonly found in malware

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533465
Start date and time:	2024-10-14 18:24:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/97@2/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: na.elf

Process Tree

system is lnxubuntu20

na.elf (PID: 5449, Parent: 5372, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5451, Parent: 5449)

na.elf New Fork (PID: 5452, Parent: 5449)

na.elf New Fork (PID: 5454, Parent: 5449)

na.elf New Fork (PID: 5457, Parent: 5454)

na.elf New Fork (PID: 5458, Parent: 5454)

na.elf New Fork (PID: 5464, Parent: 5454)

na.elf New Fork (PID: 5467, Parent: 5454)

na.elf New Fork (PID: 5468, Parent: 5454)

systemd New Fork (PID: 5505, Parent: 1)

dbus-daemon (PID: 5505, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5506, Parent: 2935)

pulseaudio (PID: 5506, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5507, Parent: 1)

rsyslogd (PID: 5507, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gvfsd-fuse New Fork (PID: 5508, Parent: 3122)

fusermount (PID: 5508, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5520, Parent: 1)

systemd-logind (PID: 5520, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5577, Parent: 1)

rtkit-daemon (PID: 5577, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5580, Parent: 1)

polkitd (PID: 5580, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5586, Parent: 1)

agetty (PID: 5586, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5587, Parent: 1400)

Default (PID: 5587, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5588, Parent: 1400)

Default (PID: 5588, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5589, Parent: 1400)

Default (PID: 5589, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5592, Parent: 2935)

dbus-daemon (PID: 5592, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5593, Parent: 1)

gpu-manager (PID: 5593, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5594, Parent: 5593)

sh (PID: 5594, Parent: 5593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5595, Parent: 5594)

grep (PID: 5595, Parent: 5594, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5596, Parent: 5593)

sh (PID: 5596, Parent: 5593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5597, Parent: 5596)

grep (PID: 5597, Parent: 5596, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5598, Parent: 5593)

sh (PID: 5598, Parent: 5593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5599, Parent: 5598)

grep (PID: 5599, Parent: 5598, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5600, Parent: 5593)

sh (PID: 5600, Parent: 5593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5601, Parent: 5600)

grep (PID: 5601, Parent: 5600, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5602, Parent: 5593)

sh (PID: 5602, Parent: 5593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5603, Parent: 5602)

grep (PID: 5603, Parent: 5602, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5604, Parent: 5593)

sh (PID: 5604, Parent: 5593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5605, Parent: 5604)

grep (PID: 5605, Parent: 5604, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5606, Parent: 5593)

sh (PID: 5606, Parent: 5593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5607, Parent: 5606)

grep (PID: 5607, Parent: 5606, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5608, Parent: 5593)

sh (PID: 5608, Parent: 5593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5609, Parent: 5608)

grep (PID: 5609, Parent: 5608, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5610, Parent: 1)

generate-config (PID: 5610, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5611, Parent: 5610)

pkill (PID: 5611, Parent: 5610, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5614, Parent: 1)

gdm-wait-for-drm (PID: 5614, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5619, Parent: 1)

gdm3 (PID: 5619, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5623, Parent: 5619)

plymouth (PID: 5623, Parent: 5619, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5640, Parent: 5619)

gdm-session-worker (PID: 5640, Parent: 5619, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5646, Parent: 5640)

gdm-wayland-session (PID: 5646, Parent: 5640, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5650, Parent: 5646)

dbus-run-session (PID: 5650, Parent: 5646, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5651, Parent: 5650)

dbus-daemon (PID: 5651, Parent: 5650, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5655, Parent: 5651)

dbus-daemon New Fork (PID: 5656, Parent: 5655)

false (PID: 5656, Parent: 5655, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5658, Parent: 5651)

dbus-daemon New Fork (PID: 5659, Parent: 5658)

false (PID: 5659, Parent: 5658, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5660, Parent: 5651)

dbus-daemon New Fork (PID: 5661, Parent: 5660)

false (PID: 5661, Parent: 5660, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5662, Parent: 5651)

dbus-daemon New Fork (PID: 5663, Parent: 5662)

false (PID: 5663, Parent: 5662, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5664, Parent: 5651)

dbus-daemon New Fork (PID: 5665, Parent: 5664)

false (PID: 5665, Parent: 5664, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5666, Parent: 5651)

dbus-daemon New Fork (PID: 5667, Parent: 5666)

false (PID: 5667, Parent: 5666, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5671, Parent: 5651)

dbus-daemon New Fork (PID: 5672, Parent: 5671)

false (PID: 5672, Parent: 5671, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5652, Parent: 5650)

gnome-session (PID: 5652, Parent: 5650, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5652, Parent: 5650, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5673, Parent: 5652)

session-migration (PID: 5673, Parent: 5652, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5674, Parent: 5652)

sh (PID: 5674, Parent: 5652, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5674, Parent: 5652, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5702, Parent: 5619)

gdm-session-worker (PID: 5702, Parent: 5619, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5707, Parent: 5702)

gdm-x-session (PID: 5707, Parent: 5702, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5709, Parent: 5707)

Xorg (PID: 5709, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5709, Parent: 5707, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5709, Parent: 5707, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5718, Parent: 5709)

sh (PID: 5718, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5719, Parent: 5718)

xkbcomp (PID: 5719, Parent: 5718, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 5964, Parent: 5709)

sh (PID: 5964, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5965, Parent: 5964)

xkbcomp (PID: 5965, Parent: 5964, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5724, Parent: 5707)

Default (PID: 5724, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5725, Parent: 5707)

dbus-run-session (PID: 5725, Parent: 5707, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5726, Parent: 5725)

dbus-daemon (PID: 5726, Parent: 5725, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5742, Parent: 5726)

dbus-daemon New Fork (PID: 5743, Parent: 5742)

at-spi-bus-launcher (PID: 5743, Parent: 5742, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5748, Parent: 5743)

dbus-daemon (PID: 5748, Parent: 5743, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6123, Parent: 5748)

dbus-daemon New Fork (PID: 6124, Parent: 6123)

at-spi2-registryd (PID: 6124, Parent: 6123, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5770, Parent: 5726)

dbus-daemon New Fork (PID: 5771, Parent: 5770)

false (PID: 5771, Parent: 5770, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5773, Parent: 5726)

dbus-daemon New Fork (PID: 5774, Parent: 5773)

false (PID: 5774, Parent: 5773, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5775, Parent: 5726)

dbus-daemon New Fork (PID: 5776, Parent: 5775)

false (PID: 5776, Parent: 5775, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5777, Parent: 5726)

dbus-daemon New Fork (PID: 5778, Parent: 5777)

false (PID: 5778, Parent: 5777, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5779, Parent: 5726)

dbus-daemon New Fork (PID: 5780, Parent: 5779)

false (PID: 5780, Parent: 5779, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5781, Parent: 5726)

dbus-daemon New Fork (PID: 5782, Parent: 5781)

false (PID: 5782, Parent: 5781, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5786, Parent: 5726)

dbus-daemon New Fork (PID: 5787, Parent: 5786)

false (PID: 5787, Parent: 5786, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5966, Parent: 5726)

dbus-daemon New Fork (PID: 5967, Parent: 5966)

ibus-portal (PID: 5967, Parent: 5966, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6139, Parent: 5726)

dbus-daemon New Fork (PID: 6140, Parent: 6139)

gjs (PID: 6140, Parent: 6139, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6357, Parent: 5726)

dbus-daemon New Fork (PID: 6358, Parent: 6357)

false (PID: 6358, Parent: 6357, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5727, Parent: 5725)

gnome-session (PID: 5727, Parent: 5725, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5727, Parent: 5725, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5730, Parent: 5727)

gnome-session-check-accelerated (PID: 5730, Parent: 5727, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5749, Parent: 5730)

gnome-session-check-accelerated-gl-helper (PID: 5749, Parent: 5730, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5759, Parent: 5730)

gnome-session-check-accelerated-gles-helper (PID: 5759, Parent: 5730, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5788, Parent: 5727)

session-migration (PID: 5788, Parent: 5727, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5789, Parent: 5727)

sh (PID: 5789, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5789, Parent: 5727, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5957, Parent: 5789)

ibus-daemon (PID: 5957, Parent: 5789, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 5960, Parent: 5957)

ibus-memconf (PID: 5960, Parent: 5957, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 5962, Parent: 5957)

ibus-daemon New Fork (PID: 5963, Parent: 5962)

ibus-x11 (PID: 5963, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6176, Parent: 5957)

ibus-engine-simple (PID: 6176, Parent: 5957, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6155, Parent: 5727)

sh (PID: 6155, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6155, Parent: 5727, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6157, Parent: 5727)

sh (PID: 6157, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6157, Parent: 5727, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6159, Parent: 5727)

sh (PID: 6159, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6159, Parent: 5727, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6160, Parent: 5727)

sh (PID: 6160, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6160, Parent: 5727, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6161, Parent: 5727)

sh (PID: 6161, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6161, Parent: 5727, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6348, Parent: 6161)

gsd-print-notifications New Fork (PID: 6349, Parent: 6348)

gsd-printer (PID: 6349, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6162, Parent: 5727)

sh (PID: 6162, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6162, Parent: 5727, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6163, Parent: 5727)

sh (PID: 6163, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6163, Parent: 5727, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6164, Parent: 5727)

sh (PID: 6164, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6164, Parent: 5727, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6165, Parent: 5727)

sh (PID: 6165, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6165, Parent: 5727, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6168, Parent: 5727)

sh (PID: 6168, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6168, Parent: 5727, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6169, Parent: 5727)

sh (PID: 6169, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6169, Parent: 5727, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6172, Parent: 5727)

sh (PID: 6172, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6172, Parent: 5727, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6177, Parent: 5727)

sh (PID: 6177, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6177, Parent: 5727, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6180, Parent: 5727)

sh (PID: 6180, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6180, Parent: 5727, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6601, Parent: 5727)

sh (PID: 6601, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6601, Parent: 5727, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6611, Parent: 5727)

sh (PID: 6611, Parent: 5727, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6611, Parent: 5727, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5703, Parent: 5619)

Default (PID: 5703, Parent: 5619, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5704, Parent: 5619)

Default (PID: 5704, Parent: 5619, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5625, Parent: 1)

accounts-daemon (PID: 5625, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5635, Parent: 5625)

language-validate (PID: 5635, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5636, Parent: 5635)

language-options (PID: 5636, Parent: 5635, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5637, Parent: 5636)

sh (PID: 5637, Parent: 5636, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5638, Parent: 5637)

locale (PID: 5638, Parent: 5637, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5639, Parent: 5637)

grep (PID: 5639, Parent: 5637, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5648, Parent: 1410)

dbus-daemon (PID: 5648, Parent: 1410, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5811, Parent: 1)

systemd-localed (PID: 5811, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 5975, Parent: 1)

upowerd (PID: 5975, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6013, Parent: 1410)

pulseaudio (PID: 6013, Parent: 1410, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6016, Parent: 1)

geoclue (PID: 6016, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6128, Parent: 1)

wpa_supplicant (PID: 6128, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6133, Parent: 1)

avahi-daemon (PID: 6133, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6135, Parent: 6133)

systemd New Fork (PID: 6137, Parent: 1)

packagekitd (PID: 6137, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6154, Parent: 6137)

dpkg (PID: 6154, Parent: 6137, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6197, Parent: 1)

systemd-hostnamed (PID: 6197, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6392, Parent: 1)

ModemManager (PID: 6392, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6437, Parent: 1)

colord (PID: 6437, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6604, Parent: 6437)

colord-sane (PID: 6604, Parent: 6437, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6446, Parent: 1)

systemd-localed (PID: 6446, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6622, Parent: 1)

fprintd (PID: 6622, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5454.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5454.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5452.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5452.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5449.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5449.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5457.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5457.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5451.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5451.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5458.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5458.1.00007f0994017000.00007f099402d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5449	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5449	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5451	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5451	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5452	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5452	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5454	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5454	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5457	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5457	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5458	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5458	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 19 entries

String: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspctelnetbotdvrHelperbyte-mirai.kro.kr68.183.18.151

Source: global traffic

TCP traffic: 192.168.2.13:45214 -> 154.216.20.119:7777

Source: /usr/sbin/rsyslogd (PID: 5507)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5619)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5651)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5652)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5709)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5726)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5748)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5727)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5957)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 126.55.202.118
Source: unknown	TCP traffic detected without corresponding DNS query: 63.28.199.118
Source: unknown	TCP traffic detected without corresponding DNS query: 60.96.120.42
Source: unknown	TCP traffic detected without corresponding DNS query: 177.182.18.225
Source: unknown	TCP traffic detected without corresponding DNS query: 218.39.98.135
Source: unknown	TCP traffic detected without corresponding DNS query: 73.187.61.206
Source: unknown	TCP traffic detected without corresponding DNS query: 179.233.89.233
Source: unknown	TCP traffic detected without corresponding DNS query: 38.23.57.38
Source: unknown	TCP traffic detected without corresponding DNS query: 74.232.239.4
Source: unknown	TCP traffic detected without corresponding DNS query: 85.145.120.147
Source: unknown	TCP traffic detected without corresponding DNS query: 181.132.162.92
Source: unknown	TCP traffic detected without corresponding DNS query: 36.142.239.179
Source: unknown	TCP traffic detected without corresponding DNS query: 99.156.15.50
Source: unknown	TCP traffic detected without corresponding DNS query: 183.137.117.249
Source: unknown	TCP traffic detected without corresponding DNS query: 189.174.28.184
Source: unknown	TCP traffic detected without corresponding DNS query: 76.53.131.211
Source: unknown	TCP traffic detected without corresponding DNS query: 13.24.212.15
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.187.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.67.43.8
Source: unknown	TCP traffic detected without corresponding DNS query: 121.236.173.37
Source: unknown	TCP traffic detected without corresponding DNS query: 76.236.161.187
Source: unknown	TCP traffic detected without corresponding DNS query: 173.242.108.196
Source: unknown	TCP traffic detected without corresponding DNS query: 80.165.40.65
Source: unknown	TCP traffic detected without corresponding DNS query: 209.147.78.236
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.189.244
Source: unknown	TCP traffic detected without corresponding DNS query: 184.106.60.156
Source: unknown	TCP traffic detected without corresponding DNS query: 2.241.132.137
Source: unknown	TCP traffic detected without corresponding DNS query: 86.81.172.224
Source: unknown	TCP traffic detected without corresponding DNS query: 73.231.62.91
Source: unknown	TCP traffic detected without corresponding DNS query: 101.62.251.77
Source: unknown	TCP traffic detected without corresponding DNS query: 189.105.255.119
Source: unknown	TCP traffic detected without corresponding DNS query: 206.133.57.136
Source: unknown	TCP traffic detected without corresponding DNS query: 146.100.165.28
Source: unknown	TCP traffic detected without corresponding DNS query: 129.165.112.135
Source: unknown	TCP traffic detected without corresponding DNS query: 48.231.58.18
Source: unknown	TCP traffic detected without corresponding DNS query: 202.185.87.252
Source: unknown	TCP traffic detected without corresponding DNS query: 174.144.239.204
Source: unknown	TCP traffic detected without corresponding DNS query: 196.38.86.89
Source: unknown	TCP traffic detected without corresponding DNS query: 176.220.66.203
Source: unknown	TCP traffic detected without corresponding DNS query: 66.58.7.17
Source: unknown	TCP traffic detected without corresponding DNS query: 151.113.123.212
Source: unknown	TCP traffic detected without corresponding DNS query: 47.179.144.117
Source: unknown	TCP traffic detected without corresponding DNS query: 37.191.76.19
Source: unknown	TCP traffic detected without corresponding DNS query: 95.5.124.222
Source: unknown	TCP traffic detected without corresponding DNS query: 139.180.24.32
Source: unknown	TCP traffic detected without corresponding DNS query: 206.143.192.117
Source: unknown	TCP traffic detected without corresponding DNS query: 165.119.100.125
Source: unknown	TCP traffic detected without corresponding DNS query: 180.47.107.134
Source: unknown	TCP traffic detected without corresponding DNS query: 170.32.6.169
Source: unknown	TCP traffic detected without corresponding DNS query: 134.124.60.162

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: Xorg.0.log.151.dr, syslog.26.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.151.dr, syslog.26.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.26.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c
Source: ELF static info symbol of initial sample	Name: attack_method_greeth
Source: ELF static info symbol of initial sample	Name: attack_method_greip
Source: ELF static info symbol of initial sample	Name: attack_method_std
Source: ELF static info symbol of initial sample	Name: attack_method_tcpack

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3677, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 5431, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 5451, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3677, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 5085, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 5454, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 5457, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5726)	SIGKILL sent: pid: 5742, result: successful
Source: /usr/bin/dbus-daemon (PID: 5726)	SIGKILL sent: pid: 5966, result: successful
Source: /usr/bin/dbus-daemon (PID: 5726)	SIGKILL sent: pid: 6139, result: successful
Source: /usr/bin/dbus-daemon (PID: 5748)	SIGKILL sent: pid: 6123, result: successful

Source: na.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspctelnetbotdvrHelperbyte-mirai.kro.kr68.183.18.151

Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3677, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 3680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 5431, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	SIGKILL sent: pid: 5451, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3677, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 3680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 5085, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 5454, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5457)	SIGKILL sent: pid: 5457, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5726)	SIGKILL sent: pid: 5742, result: successful
Source: /usr/bin/dbus-daemon (PID: 5726)	SIGKILL sent: pid: 5966, result: successful
Source: /usr/bin/dbus-daemon (PID: 5726)	SIGKILL sent: pid: 6139, result: successful
Source: /usr/bin/dbus-daemon (PID: 5748)	SIGKILL sent: pid: 6123, result: successful

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/97@2/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5505)	File: /proc/5505/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5508)	File: /proc/5508/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5592)	File: /proc/5592/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5651)	File: /proc/5651/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5726)	File: /proc/5726/mounts
Source: /usr/bin/dbus-daemon (PID: 5748)	File: /proc/5748/mounts
Source: /usr/bin/gjs (PID: 6140)	File: /proc/6140/mounts
Source: /usr/bin/gnome-shell (PID: 5789)	File: /proc/5789/mounts
Source: /usr/bin/dbus-daemon (PID: 5648)	File: /proc/5648/mounts

Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/seats/.#seat0iDdWZy	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127lnXN7z	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127D8Df3A	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/seats/.#seat0VtqdVC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#1273Lx2nB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c19rLRMC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127m5cnEA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/seats/.#seat0965lNB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#1276pDyLz	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c1YwlRMB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c1D5wqpD	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#1276C1ZWC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c19WhZ1A	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c1LXQDIB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c1MlJXjC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127wlENwB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/seats/.#seat0nNqwLC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127VQDjQC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/seats/.#seat04nn15z	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127JeJsmz	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/seats/.#seat08egASA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127oghIzB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c2jIiFqz	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127mzEyMC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/seats/.#seat0zTMCOz	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c2aBPr5z	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c2qI9g7y	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/users/.#127M91Rwz	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c2HBxB9B	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c26zVyez	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c2YEiEmz	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c24fh21C	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/sessions/.#c2sQDGSy	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/inhibit/.#1rJNMXy	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/inhibit/.#2GaFvMB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/inhibit/.#33Oj20y	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/inhibit/.#4lH7iFB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5520)	File: /run/systemd/inhibit/.#5q8ZvoB	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5674)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5674)	Directory: <invalid fd (10)>/..
Source: /usr/lib/xorg/Xorg (PID: 5709)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5709)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5730)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5730)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5730)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5749)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5759)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5759)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5759)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5789)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5789)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5789)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5789)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5789)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5789)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5789)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 5963)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 5963)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6157)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6157)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6159)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6159)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6160)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6160)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6162)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6162)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6180)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6180)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5625)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5625)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 5975)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 5975)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6137)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6197)	Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6392)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6392)	Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6437)	Directory: /var/lib/colord/.cache

Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6165/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6165/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6013/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6013/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6013/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6013/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6013/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6013/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6159/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6159/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6180/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6180/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6160/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/6160/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/1/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/1/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5789/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5789/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5789/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5789/cmdline	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5789/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5789/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5789/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5506/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5506/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5506/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5727/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5580)	File opened: /proc/5727/cgroup	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/3756/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/5396/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5451)	File opened: /proc/371/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5594)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5596)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5598)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5600)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5602)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5604)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5606)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5608)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5718)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 5964)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5637)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5595)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5597)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5599)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5601)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5603)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5605)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5607)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5609)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5639)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5611)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5586)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5619)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5619)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5625)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5625)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5507)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5507)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5593)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5709)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5593)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5709)	Truncated file: /var/log/Xorg.pid-5709.log

Source: /usr/bin/pulseaudio (PID: 5506)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5611)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5709)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5730)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5749)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5759)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5789)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6013)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/na.elf (PID: 5449)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5506)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5507)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5586)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5593)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5640)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5652)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5702)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5707)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5709)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5743)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6124)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5727)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5730)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5749)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5759)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5789)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 5963)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6157)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6159)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6160)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6163)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6165)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6180)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6013)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6133)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6137)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6197)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6622)	Queries kernel information via 'uname':

Source: na.elf, 5449.1.00005579dab94000.00005579dace5000.rw-.sdmp, na.elf, 5451.1.00005579dab94000.00005579dacc2000.rw-.sdmp, na.elf, 5452.1.00005579dab94000.00005579dacc2000.rw-.sdmp, na.elf, 5454.1.00005579dab94000.00005579dacc2000.rw-.sdmp, na.elf, 5457.1.00005579dab94000.00005579dacc2000.rw-.sdmp, na.elf, 5458.1.00005579dab94000.00005579dacc2000.rw-.sdmp	Binary or memory string: yU!/etc/qemu-binfmt/arm
Source: na.elf, 5451.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.225jpn
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.364] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.773] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.987] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.297] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.379] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.702] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.236] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.718] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.134] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 152.680] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.809] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.748] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.082] (--) vmware(0): depth: 24
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.148] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:34 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.047] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): Silken mouse enabled
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.733] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.656] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.118] (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.097] (--) vmware(0): w.red: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.623] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.931] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.082] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.150] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.912] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.869] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.317] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.283] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.103] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.625] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.323] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.894] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.220] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.049] (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.903] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.413] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.013] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.211] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.554] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.119] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 156.488] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:46 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.592] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.993] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.090] (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.192] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.863] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.176] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.085] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.339] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.711] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.227] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.217] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.854] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.540] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: na.elf, 5457.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp	Binary or memory string: yU/tmp/qemu-open.MSCdZQAs
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.324] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.608] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.943] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:35 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.160] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.464] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.790] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.107] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.113] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.638] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.332] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.483] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.467] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.489] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.912] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.223] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.013] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.166] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:46 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.496] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.207] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.458] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.159] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.565] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.694] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:46 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.042] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.524] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.405] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.563] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.243] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.196] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.495] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.540] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.131] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.752] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.366] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.421] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.966] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.519] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.131] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.817] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.521] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.507] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.072] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.664] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.216] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.579] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.604] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.572] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.771] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.198] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 152.738] (II) LoadModule: "vmware"
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:46 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.094] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.764] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.315] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:35 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.700] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.245] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.069] (--) vmware(0): mwidt: 1176
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.164] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.261] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.849] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.365] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.354] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.055] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.573] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.709] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.531] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.994] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.649] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.128] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.180] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 152.775] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.801] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.642] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.270] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.108] (==) vmware(0): Backing store enabled
Source: na.elf, 5457.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.MSCdZQ
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.124] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:34 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.008] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.939] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:46 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.794] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.952] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): pbase: 0xe8000000
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.780] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.239] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.631] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.124] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:46 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.396] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.439] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.873] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.433] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.016] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:34 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) LoadModule: "vmware"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.428] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.168] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.048] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.206] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 156.496] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.271] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.154] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.203] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): w.blu: 8
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.303] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.861] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.285] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.512] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.026] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.252] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.694] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.616] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.184] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.832] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:34 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 164.924] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.142] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.894] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.714] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.638] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.446] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.663] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.124] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.826] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): depth: 24
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.883] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.288] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.970] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.486] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.143] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.173] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): vis: 4
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.627] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.111] (--) vmware(0): w.blu: 8
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.208] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.543] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.001] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (WW) vmware(0): Disabling 3D support.
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.700] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: na.elf, 5449.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5451.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5452.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5454.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5457.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5458.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.381] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.886] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.021] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.055] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.719] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.722] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.958] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 153.344] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.304] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.420] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.388] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.986] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.451] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.381] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.476] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.583] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.780] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.389] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.578] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.017] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.585] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.231] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.529] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.343] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.104] (--) vmware(0): w.grn: 8
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.686] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.594] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.435] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.189] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.062] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.196] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.266] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (EE) vmware(0): Failed to open drm.
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.070] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.492] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.447] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.920] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.979] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.114] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.584] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.725] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.878] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.735] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.436] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.594] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.028] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.410] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.274] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.502] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.396] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.787] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.076] (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.564] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.508] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.323] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 156.478] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.691] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.021] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.599] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.961] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.574] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.295] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.310] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.027] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.148] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.480] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.184] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.472] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.374] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.199] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.682] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.994] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.835] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:46 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: na.elf, 5451.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp	Binary or memory string: yU/tmp/qemu-open.225jpnAs
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.404] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.344] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.402] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.742] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.603] (==) vmware(0): DPI set to (96, 96)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.280] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.974] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.092] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.173] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.981] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.077] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 164.932] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.756] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.114] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.922] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.421] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.672] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.160] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 164.940] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.259] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.679] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.655] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.043] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 153.597] (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.928] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.800] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.762] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.062] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.305] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.414] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.252] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.124] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.061] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.189] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.903] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.556] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: na.elf, 5449.1.00005579dab94000.00005579dace5000.rw-.sdmp, na.elf, 5451.1.00005579dab94000.00005579dacc2000.rw-.sdmp, na.elf, 5452.1.00005579dab94000.00005579dacc2000.rw-.sdmp, na.elf, 5454.1.00005579dab94000.00005579dacc2000.rw-.sdmp, na.elf, 5457.1.00005579dab94000.00005579dacc2000.rw-.sdmp, na.elf, 5458.1.00005579dab94000.00005579dacc2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.151.dr	Binary or memory string: [ 156.462] (EE) vmware(0): Failed to open drm.
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:38 galassia /usr/lib/gdm3/gdm-x-session[5709]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.461] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.563] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.260] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:40 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.951] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.338] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.251] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: na.elf, 5449.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5451.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5452.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5454.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5457.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp, na.elf, 5458.1.00007ffd733f3000.00007ffd73414000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:47 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.604] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.001] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.502] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:39 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.816] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.233] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 14 11:25:41 galassia /usr/lib/gdm3/gdm-x-session[5709]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.652] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 165.553] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5625)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5452.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5457.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5451.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5458.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5451, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5454, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5457, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5458, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5452.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5457.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5451.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5458.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5451, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5454, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5457, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5458, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5452.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5457.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5451.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5458.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5451, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5454, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5457, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5458, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5452.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5457.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5451.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5458.1.00007f0994017000.00007f099402d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5451, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5454, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5457, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5458, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.26.dr	false	unknown
http://wiki.x.org	Xorg.0.log.151.dr, syslog.26.dr	false	unknown
http://www.ubuntu.com/support)	Xorg.0.log.151.dr, syslog.26.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
207.98.204.145	unknown	United States	12083	WOW-INTERNETUS	false
178.74.140.57	unknown	Russian Federation	196991	SO-UPSRU	false
36.2.185.179	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
31.162.185.167	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
173.45.64.41	unknown	United States	10297	ENET-2US	false
98.199.107.194	unknown	United States	7922	COMCAST-7922US	false
40.146.93.133	unknown	United States	4249	LILLY-ASUS	false
222.18.102.177	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
194.36.245.80	unknown	Spain	15704	AS15704ES	false
166.216.208.116	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
8.70.187.12	unknown	United States	3356	LEVEL3US	false
81.169.242.82	unknown	Germany	6724	STRATOSTRATOAGDE	false
143.214.190.169	unknown	United States	1602	DNIC-AS-01602US	false
38.150.132.222	unknown	United States	174	COGENT-174US	false
163.71.42.39	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
124.122.130.82	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	false
202.98.105.200	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
24.149.74.193	unknown	United States	4922	SHENTELUS	false
197.237.248.173	unknown	Kenya	15399	WANANCHI-KE	false
62.53.240.210	unknown	Germany	6805	TDDE-ASN1DE	false
126.42.103.247	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
138.141.150.215	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
40.72.255.234	unknown	China	58593	BLUECLOUDShanghaiBlueCloudTechnologyCoLtdCN	false
165.214.229.35	unknown	United States	14454	PERIMETER-ESECURITYUS	false
135.176.46.218	unknown	United States	14962	NCR-252US	false
39.100.212.205	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
117.35.167.211	unknown	China	4835	CHINANET-IDC-SNChinaTelecomGroupCN	false
202.27.23.26	unknown	Singapore	56039	SPH-SG1000ToaPayohNorthNewsCentreSG	false
100.48.158.84	unknown	United States	701	UUNETUS	false
126.9.249.36	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
141.174.246.183	unknown	United States	29601	UPM-KYMMENE-ASKuusankoskiFinlandFI	false
38.70.14.122	unknown	United States	39988	INTELLIGENT-TECHNOLOGY-SOLUTIONSUS	false
165.165.239.241	unknown	South Africa	5713	SAIX-NETZA	false
161.96.213.121	unknown	Japan	7582	UMAC-AS-APUniversityofMacauMO	false
39.84.212.162	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
184.22.246.175	unknown	Thailand	133481	AIS-FIBRE-AS-APAISFibreTH	false
96.117.251.89	unknown	United States	7922	COMCAST-7922US	false
173.66.71.171	unknown	United States	701	UUNETUS	false
192.191.157.68	unknown	United States	63470	DATAVALET-ASNCA	false
212.118.100.183	unknown	Saudi Arabia	34397	CYBERIA-RUHCyberiaRiyadhAutonomousSystemSA	false
136.173.78.17	unknown	Luxembourg	43375	EP-ASEU	false
117.175.162.242	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
121.16.42.249	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
120.69.195.242	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
67.164.101.83	unknown	United States	7922	COMCAST-7922US	false
50.14.145.198	unknown	United States	2686	ATGS-MMD-ASUS	false
68.162.84.167	unknown	United States	701	UUNETUS	false
191.104.39.121	unknown	Colombia	61317	ASDETUKhttpwwwheficedcomGB	false
171.4.112.17	unknown	Thailand	45758	TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH	false
186.63.15.252	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
104.247.172.128	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false
97.65.77.75	unknown	United States	3549	LVLT-3549US	false
186.77.99.137	unknown	Nicaragua	14754	TelguaGT	false
69.1.193.167	unknown	United States	26091	INDDCUS	false
138.3.141.65	unknown	Sweden	264524	CunhaeZanatotelecomLTDAMEBR	false
42.7.180.67	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
96.144.25.45	unknown	United States	7922	COMCAST-7922US	false
161.93.54.142	unknown	Japan	14298	EPA-NETUS	false
59.174.186.92	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
14.43.113.38	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
188.0.135.43	unknown	Kazakhstan	35104	KTC-ASKZ	false
18.116.3.132	unknown	United States	3	MIT-GATEWAYSUS	false
36.47.138.65	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
8.157.25.232	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
222.206.88.160	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
223.40.86.10	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
78.171.46.125	unknown	Turkey	9121	TTNETTR	false
133.234.65.81	unknown	Japan	7682	HOTNETHOKKAIDOTELECOMMUNICATIONSNETWORKCoIncJP	false
189.159.186.147	unknown	Mexico	8151	UninetSAdeCVMX	false
5.106.241.198	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
78.197.225.142	unknown	France	12322	PROXADFR	false
194.1.14.61	unknown	Slovakia (SLOVAK Republic)	2607	SANETSlovakAcademicNetworkSK	false
166.21.156.100	unknown	United States	7834	L3HARRIS-TECHNOLOGIESUS	false
179.0.33.66	unknown	Costa Rica	262174	NEURALSOFTSRLAR	false
89.174.119.72	unknown	Poland	206957	INTERSATPL	false
40.212.142.83	unknown	United States	4249	LILLY-ASUS	false
69.13.71.42	unknown	United States	54489	CORESPACE-DALUS	false
158.181.22.14	unknown	Kyrgyzstan	41750	AS-MEGALINE-KG	false
151.121.27.115	unknown	United States	4152	USDA-1US	false
118.239.189.246	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
167.185.202.219	unknown	United States	15071	BAX-BGPUS	false
219.49.231.211	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
73.4.252.15	unknown	United States	7922	COMCAST-7922US	false
91.140.204.11	unknown	Kuwait	3225	GULFNET-KUWAITKW	false
216.172.19.147	unknown	United States	7029	WINDSTREAMUS	false
162.170.141.120	unknown	United States	21928	T-MOBILE-AS21928US	false
134.74.249.55	unknown	United States	31822	CITY-UNIVERSITY-OF-NEW-YORKUS	false
167.72.169.14	unknown	United States	4193	WA-STATE-GOVUS	false
34.184.249.189	unknown	United States	2686	ATGS-MMD-ASUS	false
133.9.169.82	unknown	Japan	17956	WASEDAWASEDAUniversityJP	false
83.235.207.1	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
118.102.27.150	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
160.44.9.247	unknown	Germany	34086	SCZN-ASDE	false
17.128.174.197	unknown	United States	714	APPLE-ENGINEERINGUS	false
149.237.153.45	unknown	Germany	12843	TELEMAXXDE	false
107.13.105.226	unknown	United States	11426	TWC-11426-CAROLINASUS	false
97.143.15.17	unknown	United States	6167	CELLCO-PARTUS	false
101.186.140.139	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
203.101.40.176	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
60.139.247.208	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
207.98.204.145	uOwBMTUHGg.elf	Get hash	malicious	Mirai	Browse
178.74.140.57	5BfhgIXvAy	Get hash	malicious	Mirai	Browse
178.74.140.57	TnKUV9faWF	Get hash	malicious	Mirai	Browse
163.71.42.39	im16t4wCvU.elf	Get hash	malicious	Mirai	Browse
197.237.248.173	H0rLDuLHwH.elf	Get hash	malicious	Mirai	Browse
	notabotnet.i686.elf	Get hash	malicious	Mirai	Browse
	arm	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
31.162.185.167	lS9yzwGRef.elf	Get hash	malicious	Mirai	Browse
98.199.107.194	percarm	Get hash	malicious	Mirai	Browse
98.199.107.194	tGrFLjHHcD	Get hash	malicious	Mirai	Browse
40.146.93.133	boat.arm6.elf	Get hash	malicious	Mirai	Browse
222.18.102.177	arm	Get hash	malicious	Mirai Moobot	Browse
81.169.242.82	ppc.elf	Get hash	malicious	Mirai	Browse
143.214.190.169	dx86	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-mirai.kro.kr	cenSXPimaG.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	2UngC9fiGa.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	0wG3Y7nLHa.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	XvAqhy3FO6.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	970Qh1XiFt.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WOW-INTERNETUS	na.elf	Get hash	malicious	Mirai, Moobot	Browse	67.149.59.153
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	24.35.39.246
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	24.42.152.152
	na.elf	Get hash	malicious	Mirai	Browse	69.47.118.7
	bIb2gpepKH.elf	Get hash	malicious	Mirai	Browse	69.1.16.39
	na.elf	Get hash	malicious	Unknown	Browse	68.179.175.154
	na.elf	Get hash	malicious	Mirai	Browse	207.98.204.134
	gkjeNrdkot.elf	Get hash	malicious	Mirai	Browse	67.149.12.102
	na.elf	Get hash	malicious	Mirai	Browse	207.98.163.54
	na.elf	Get hash	malicious	Mirai	Browse	24.214.49.32
ROSTELECOM-ASRU	na.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.184.52.198
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.50.150.156
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	95.37.181.37
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	178.68.194.55
	4Y8rbNhkaR.elf	Get hash	malicious	Mirai, Okiru	Browse	109.225.10.32
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	178.71.159.88
	na.elf	Get hash	malicious	Mirai	Browse	94.25.52.51
	arm7.nn-20241014-0317.elf	Get hash	malicious	Mirai, Okiru	Browse	31.181.83.136
	o5DbX8v3ZW.elf	Get hash	malicious	Mirai	Browse	89.109.59.125
	QmMz1SXUn8.elf	Get hash	malicious	Mirai	Browse	188.145.186.174
SO-UPSRU	jNGMZWmt23.elf	Get hash	malicious	Mirai	Browse	178.74.140.26
	ZPPEqPIBy7.elf	Get hash	malicious	Unknown	Browse	178.74.140.10
	V4zFzdCyty.elf	Get hash	malicious	Mirai, Moobot	Browse	178.74.140.54
	datFGBhnqF.elf	Get hash	malicious	Mirai	Browse	178.74.140.62
	SXfiF4NeaQ.elf	Get hash	malicious	Mirai	Browse	178.74.139.12
	mg7INGUtNT.elf	Get hash	malicious	Mirai	Browse	178.74.139.28
	LBVJ3OoBHX.elf	Get hash	malicious	Mirai	Browse	178.74.140.69
	XXEEnTN5Xb.elf	Get hash	malicious	Mirai, Okiru	Browse	178.74.188.43
	jjuKRgQ1rt.elf	Get hash	malicious	Mirai	Browse	178.74.188.43
	z3hir.arm.elf	Get hash	malicious	Mirai	Browse	178.74.140.65
VECTANTARTERIANetworksCorporationJP	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	157.14.236.55
	YsI7t2OC5q.elf	Get hash	malicious	Mirai	Browse	115.179.146.93
	na.elf	Get hash	malicious	Mirai	Browse	220.158.75.60
	na.elf	Get hash	malicious	Mirai	Browse	210.131.197.118
	lByv6mqTCJ.exe	Get hash	malicious	FormBook	Browse	183.181.83.131
	3wgZ0nlbTe.exe	Get hash	malicious	FormBook	Browse	183.181.83.131
	na.elf	Get hash	malicious	Unknown	Browse	124.110.133.201
	RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe	Get hash	malicious	FormBook	Browse	183.181.83.131
	7v8szLCQAn.exe	Get hash	malicious	FormBook	Browse	183.181.83.131
	w64HYOhfv1.exe	Get hash	malicious	FormBook	Browse	183.181.83.131

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5656/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5659/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5661/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5663/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5665/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5667/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5672/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5743/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5771/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5774/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5776/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5778/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5780/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5782/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5787/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5967/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6124/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6140/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6358/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:7o:c
MD5:	F6039FA3BCEE0B360FF8119F504E22B8
SHA1:	D079184ADC132003831F0F7E2ECA051427D2955A
SHA-256:	B8C83235B34C3791CC7C3359AC1E41FE6CAE9D271F0948F2739BBC69EFF3CCAD
SHA-512:	648B7223067FEFFC25090BC12C0BEF00FEEACFDCD169BD50966ED4DF71D856D51E7877C486123825B247B00D8C72AB650E1395CBA5150B6E29DBEF961BC91DB8
Malicious:	false
Preview:	6133.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:GV:GV
MD5:	6D37C83AD6D19173A67A06E1C598755B
SHA1:	1E6A36E058B62F8C6FA901E2573EBF834A241A8F
SHA-256:	72EAE3C5CBF1F2888C978BD2E897ACF84FB56E120485CD94A63EA27841A01890
SHA-512:	C12A4E5BA1AB765525C61A633BF12C4D48F863238F0262356D3720506759724359D18BC8164B18ED90906508CAECC95FF9CA4D72BFDEA0893C5CD64F6F4AC638
Malicious:	false
Preview:	5619.

/run/systemd/inhibit/.#1rJNMXy

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifhvytqYAIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfhvyt0ApLHK7wR9n
MD5:	7B6B87A62B3619C4C3B5E00D441781EB
SHA1:	409D427E9D98AC3FE60D86F493049AC0142708F8
SHA-256:	086D28F999A117C89D208DA8C533CCD3C74A5B470A37526A67F7FF5B9C4558B4
SHA-512:	D76A7EEC6DD020F103A9963723991C3472522B90F34B4E9ACC81CE9B3850F6FCFE887A43059F49ED5020286B6C0B67A643280417A1DD962EF29F42175C35A12E
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5975.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2GaFvMB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.209300645304899
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+aLqKLXv0Rsz:qgFqXQXTI1IlhqKjcRsz
MD5:	2224C8F390F8439274D24DFA771C67B5
SHA1:	EF312FD270EBE087C936DDF66FCDCABF7345AD1E
SHA-256:	FA4C2C0649385467F1F9D4A64D744C0D8EA6BAE31D8E0855B5A29794A4F61F02
SHA-512:	DB82F8267D23CB61CED0082483E43B96B14EAD0B2F5D8EFBF754676AE0FF83CB812896C3100B8D8A019916CD6F51B86C5407F526C63BCA429D1D4916D4AB4E9A
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6165.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#33Oj20y

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++bR3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+aLqKLXv0RT
MD5:	ED70644DDB61A69C3862A62BF830A741
SHA1:	641FF623D9E8719F4646BABE3202B261AC7EC6E5
SHA-256:	6863B1938DDFC0BAB53DB934C83D058B403D70AB7FEC2A632598201E96EC4A4F
SHA-512:	8B8363BC404334B3271DF8F57FD564C73BE6593612994B75244277405BD08AF32C18EF24EEC1E7D08395150A75588935858C7E4FE9A6F80B6A8C7D6E724265A9
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6165.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4lH7iFB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.165199761184817
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++/j4iXulpv5RX8/SflY:SbFuFyL8OAAx+umlpLRS
MD5:	DDFD6C908EDECB9D4FCBC52073728C49
SHA1:	268C6302EAA83C6CB8565D68523FACA9E90F105D
SHA-256:	2C3D9EFF2064FB9512E8844F9CCEBB17EB82F6214DE533858CBBE8B39B6D0E7D
SHA-512:	D5E83B4C0E50DB19305CC1D227A0F01DA255897952ECD2E2BB1F8B29C63EB4ABF515A87FE066553E825E4A0B5E0FE74F7A29F79B7869848DD7D0C88140E62A01
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6180.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/inhibit/.#5q8ZvoB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.986393731004737
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifP+qvDkBoDWicRF2Tg+tX8/Sf5:SbFuFyL8OAApftDjDJcjKR5
MD5:	6BA00F969C6C9861E1F67155F885D57F
SHA1:	DA32449F3EF51D9FB23D8FA0A9C358041D34A659
SHA-256:	5A8AA2219294A6D06EF5B8B44882041CEC12A0E23DEFE782ED6B99C029DDA309
SHA-512:	CAE127EC0586243A829ED2C414CE133037D575C8665FBDCA9A4F87516887BAE9F030E6D791B29E4AA66EBF6E5001952665D864CAC27F2FDBC2B2A62FDD7E4A3D
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6392.WHO=ModemManager.WHY=ModemManager needs to reset devices.FIFO=/run/systemd/inhibit/5.ref.

/run/systemd/seats/.#seat04nn15z

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat08egASA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0965lNB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0VtqdVC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0iDdWZy

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0nNqwLC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0zTMCOz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/sessions/.#c19WhZ1A

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.452546979314398
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKDvTgXDCexkR:qgFqPuFN6IG0n99x2xayWKDvTgzCeqR
MD5:	34F9830F3931A608D38DAB196C0B1C29
SHA1:	E60F0640E37DB1C5157229A2105462993355AC5F
SHA-256:	25B5C4EFC55BC9F4967174FEEADE6C44A4AE53E1869433FDA4A1E38C8133D734
SHA-512:	96E46BA77A1716E94EA5EAF12E2052D829878F7849B39EC1E94F62E8F0AA1936DA9CC93C8E45D45317C43191B5E0D5C0AFD39611AE35BB904E86EB7618DAD714
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5640.REALTIME=1728923120324096.MONOTONIC=138472944.CONTROLLER=:1.15.

/run/systemd/sessions/.#c19rLRMC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.494196197735314
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffC5hBxfx2xNIByy6GBKDvTgXDCeG:qgFqPuFVuRZI4BKB9x2xayWKDvTgzCeG
MD5:	D6AB6F7CCAA40AFB236CC42F7DD9EE14
SHA1:	4DD31792724496D47464BB30A299EA1B185B2D3A
SHA-256:	2AF8F7EAA56828ABB7FD9A2AC5E61BC30202E82F86DAFD889ABB12EE2BA6A7CB
SHA-512:	77B46B18638CC49C96079026426F5794A558EDD4B99DA826B72FE037CEDEC4504095913779FCA41FFFE9D0148272657ABEF128147BBE8BD84A9AEC69F522AC86
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7810.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5640.REALTIME=1728923120324096.MONOTONIC=138472944.

/run/systemd/sessions/.#c1D5wqpD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.43894669285789
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKDvTgXDCeG:qgFqPuFN6IG0n99x2xayWKDvTgzCeG
MD5:	E0936D8601B79C576B1D56A5876D7FC5
SHA1:	AFF9F2FE337CB88ECD0C5BDFC83F94E8EEA6F6DE
SHA-256:	20BD954D661C82AD08A02062C5E1BB110F1AC280F87D9E2C642A04D6E49A4709
SHA-512:	98E7A82BB08099A164B30F9A7219A4EB8D961085F0D802B9C5514F8440CC6EBD35C83887FB08AE0C4B02C28D13957F7A57B611B091F4ACF9FF5E57E88728BDF4
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5640.REALTIME=1728923120324096.MONOTONIC=138472944.

/run/systemd/sessions/.#c1LXQDIB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.43894669285789
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKDvTgXDCeG:qgFqPuFN6IG0n99x2xayWKDvTgzCeG
MD5:	E0936D8601B79C576B1D56A5876D7FC5
SHA1:	AFF9F2FE337CB88ECD0C5BDFC83F94E8EEA6F6DE
SHA-256:	20BD954D661C82AD08A02062C5E1BB110F1AC280F87D9E2C642A04D6E49A4709
SHA-512:	98E7A82BB08099A164B30F9A7219A4EB8D961085F0D802B9C5514F8440CC6EBD35C83887FB08AE0C4B02C28D13957F7A57B611B091F4ACF9FF5E57E88728BDF4
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5640.REALTIME=1728923120324096.MONOTONIC=138472944.

/run/systemd/sessions/.#c1MlJXjC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.397091512126877
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBKDvTgXDCeG:qgFqPuFdDJIi9x2xayWKDvTgzCeG
MD5:	CFA84CB117674E81221E95068B38C456
SHA1:	25D381323363C5BAD0875AE0863C29B3F792F6DE
SHA-256:	07418B3392A34285B356BB3042979AD951CA4DCB7A8AFE194FC4FA5F28740176
SHA-512:	B758F0392A64A0649A9A4958D31B53517489110A8A2864BBAF6585AEDDE28626FE274B340697744551DC624484850CC3835ED732BAF0DCB746AA0666E41A4867
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5640.REALTIME=1728923120324096.MONOTONIC=138472944.

/run/systemd/sessions/.#c1YwlRMB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.43894669285789
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKDvTgXDCeG:qgFqPuFN6IG0n99x2xayWKDvTgzCeG
MD5:	E0936D8601B79C576B1D56A5876D7FC5
SHA1:	AFF9F2FE337CB88ECD0C5BDFC83F94E8EEA6F6DE
SHA-256:	20BD954D661C82AD08A02062C5E1BB110F1AC280F87D9E2C642A04D6E49A4709
SHA-512:	98E7A82BB08099A164B30F9A7219A4EB8D961085F0D802B9C5514F8440CC6EBD35C83887FB08AE0C4B02C28D13957F7A57B611B091F4ACF9FF5E57E88728BDF4
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5640.REALTIME=1728923120324096.MONOTONIC=138472944.

/run/systemd/sessions/.#c24fh21C

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.444615235877752
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBhjgXDzTqXd3cs:qgFqPuFNuCH0nI9x2xayWhjgzzTqlcs
MD5:	68A8849C29D34DE76C0206EF7DCEBDB7
SHA1:	513E62F150B2E30EE409689CF3E0F015F9CE08D1
SHA-256:	98EA24E7850F4BE953D23F813974F7B61B1BCC0B7DAED028F55E3121D383980C
SHA-512:	49DD406CE0958D151B74DA14F3A0F65BBE51F6AF966509BDA9D629DE156B2500C399F2DEA809C5C00EF81618711DC308A2C073B6DADFF5524EAC681A72E9FEB5
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5702.REALTIME=1728923131202062.MONOTONIC=149350910.CONTROLLER=:1.19.DEVICES=13:64 13:65 13:67 .

/run/systemd/sessions/.#c26zVyez

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.421624775682229
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBhjgXDzTqXd33:qgFqPuFNuCH0nI9x2xayWhjgzzTql3
MD5:	29BDEA0B6BA0A5DCB68DB5AB5D0BCB13
SHA1:	C896617A60C8053166217886ABD7876150CC3224
SHA-256:	74AD988006BE0DDA7C5D9B30B55705B109B13142416FD5AD526EBDB4A81A3D39
SHA-512:	C5FC03DD71770049FE0879264CA1FDA84395AF9BD4DBC30B185750085FC160C4ADFF92B99F40F6BC9EAA34B7C9C1FCCE6DEC224A3A594044D4D97EEC83C2AFDA
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5702.REALTIME=1728923131202062.MONOTONIC=149350910.CONTROLLER=:1.19.DEVICES=13:64 .

/run/systemd/sessions/.#c2HBxB9B

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.409442252267975
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBhjgXDzTqXd31:qgFqPuFNuCH0nI9x2xayWhjgzzTql1
MD5:	5D83B0FEB769E745428A3B8B682DE6F4
SHA1:	4448E007639887C7894A737490B9EDDC63C3E48E
SHA-256:	174D828742616160386814F08DEAD3640AC475C534383888F21B8DC368FF53AD
SHA-512:	B94333C9B464C82A0C84F560653188E5010DA5590D08B572B5C1E2E5E4EDC1F71D6DE4263581EFA091A2690ADDEBA84E452ADEAD6C4319A18718A510B2727615
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5702.REALTIME=1728923131202062.MONOTONIC=149350910.CONTROLLER=:1.19.

/run/systemd/sessions/.#c2YEiEmz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.435942064268524
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBhjgXDzTqXd3M3:qgFqPuFNuCH0nI9x2xayWhjgzzTqlM3
MD5:	CC50DC42A52941C2B6D4D88120F7FFB5
SHA1:	64CC5C6315DC8C6EA301592CC373A0EADC8618F8
SHA-256:	2C345217DDD28800C1E9DB242177C36668BA905566228876B12D99158EF4350E
SHA-512:	C054F79B345047C565210373F9B70CD10EDCDEEE1031F429202FE0F14996951DC0395FB7FC6FE19AC47B1959091C39366DD03EFA924771B23419A7E3A6D46BA4
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5702.REALTIME=1728923131202062.MONOTONIC=149350910.CONTROLLER=:1.19.DEVICES=13:65 13:64 .

/run/systemd/sessions/.#c2aBPr5z

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.399755857917373
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBhjgXDzTqXx:qgFqPuFNuCH0nI9x2xayWhjgzzTqB
MD5:	8EC44D45730E6F4F8C64DD1654DE6672
SHA1:	229C28A86C1E0F7D85DBED83DEACD28ABDC46DEA
SHA-256:	D46F3662A1D117EF589E8C7D12DC9A91C882326539AD77AC0B8C8BB02EDDE0C2
SHA-512:	7A8C8754BFF12A71E2F8B62E8F9959C85E031BF9AC8DFF3198458ACCEBF0E336D19AE78611F4E7BCFC1711B8CCC88B41B12D48C7399A1C1CA6E4ED3DF7015D95
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5702.REALTIME=1728923131202062.MONOTONIC=149350910.

/run/systemd/sessions/.#c2jIiFqz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.462619753195712
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffC8gkBxfx2xNIByy6GBhjgXDzTqXx:qgFqPuFVuRpCvB689x2xayWhjgzzTqB
MD5:	7EDF2FB820C538A84F020D09A846B69F
SHA1:	4D3811D198909C97B92631DB340FEE70CA636267
SHA-256:	3DFE90FDA0613303DEE1B7ADFF4E26619DFC2C9CFC81D1DDE4C4AE5416D900EA
SHA-512:	DD9A3EC60EF128C91B23C15DCBB534FBAA7F631B0160EBC83911339E82E1F6F034629FF82A41A1512500A0B15C14198039C23A17D562D0DD2A970D1E3BFB75AC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7873.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5702.REALTIME=1728923131202062.MONOTONIC=149350910.

/run/systemd/sessions/.#c2qI9g7y

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.399755857917373
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBhjgXDzTqXx:qgFqPuFNuCH0nI9x2xayWhjgzzTqB
MD5:	8EC44D45730E6F4F8C64DD1654DE6672
SHA1:	229C28A86C1E0F7D85DBED83DEACD28ABDC46DEA
SHA-256:	D46F3662A1D117EF589E8C7D12DC9A91C882326539AD77AC0B8C8BB02EDDE0C2
SHA-512:	7A8C8754BFF12A71E2F8B62E8F9959C85E031BF9AC8DFF3198458ACCEBF0E336D19AE78611F4E7BCFC1711B8CCC88B41B12D48C7399A1C1CA6E4ED3DF7015D95
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5702.REALTIME=1728923131202062.MONOTONIC=149350910.

/run/systemd/sessions/.#c2sQDGSy

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.448342143676775
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBhjgXDzTqXd3cS:qgFqPuFNuCH0nI9x2xayWhjgzzTqlcS
MD5:	F5031041D7F435FF804473451C54E14E
SHA1:	C69B9CBFEA9DE7102C4E69343860C1E4D054CEE2
SHA-256:	DB03383203938DD623C977898B8F274F8F23D808335F29849D7568E5A3CD8E29
SHA-512:	AD1407465664DA4942761AB47F081F82E79D83831117CBD64C9A180B45591F2CFBCE08B1300FDCE9906EF72F9110D6DA0DB6775092D8711B42083F3315E3F213
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5702.REALTIME=1728923131202062.MONOTONIC=149350910.CONTROLLER=:1.19.DEVICES=13:64 13:65 13:66 13:67 .

/run/systemd/users/.#1273Lx2nB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.297776777762262
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBzgXDuKPC02thQc2x9sS02/g2owB:qgFq30VuR8L/ibBFgzuKPYthQHxbPYA
MD5:	DF3B790554AE73DC4CEA84E088C84762
SHA1:	B11BF1E6B4D551E44EFCBD8D7AECED6611EF0A35
SHA-256:	F3B1AF84828428A61D98210B957A57DB909FFED0B6520A4903C2BFE1E11E086C
SHA-512:	C489E13F9652F96105C68C6CE11E11171AF61E557F3026758E45DB588EBC7A13FB699DE02C5242DF4FC328CBF47CD3DDC536B454F01DFCEDA328875DF2AECEC5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1276C1ZWC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.151456026591103
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgXDuKPC02thQc2x9sS02/g2owB:qgFq30NzL/ixegzuKPYthQHxbPYA
MD5:	AD6BBDBCF88FE6C72FFB4BDA8E74A1F4
SHA1:	357B36B8BECADBFDDA881819F60648E044A95F2A
SHA-256:	54305A6DAAE98D18D34FD3E7F0BA1701A60AB167C773626FEEF5B35E23442F38
SHA-512:	CF569AAB56ADE355200AD8CFAC7F7C91DF4973B9D766EAAC9A9D5EF70D509E866897B5F0F64F177E710FF5366B326F90C2D893A56110F0E4F4B0B6EF37E786C0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1276pDyLz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.167392281571184
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgXDuKPC02thQc2x9sS02/g2owB:qgFq30z1cL/ixegzuKPYthQHxbPYA
MD5:	E44B6228408E30C98BF76C5F2B484107
SHA1:	34B6683C74C901A23F8786C7FAAAA58165B03ACD
SHA-256:	1AB0770AFA2E0F9A2BF112C558517D706BD3FF39987EAE640AB28B6B6EE25864
SHA-512:	FBDF0D2231D60C640F1CC28EED47483DDEF2C1039CAC7C742C2BB5ECEF3656415340EF8BDAFE7A85313049DB43CC1BC53508B89F42EFAF2E203F3AD8FBDCC410
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127D8Df3A

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.293997483728039
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBzgXDuKPC02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBFgzuKPYthQHtPYq9M
MD5:	81F5C5116347CD70D4FF5DFC3D062D7E
SHA1:	A9DF069E3B384B5A0BFDCBFE0B250FFFF2DB0607
SHA-256:	F3C5CA1F07450A6960B56F9C734DB3FF16D25B450437D1E209EA1741F8EC5D97
SHA-512:	F39B33A52230F823A72F0CAC8E5D88D4EC406B24245EFD2F2893FFCA47E5253B143646C87289276E88417FDEBA57DE8CDF1B9F0150D97442C7F333CADA17BFC1
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127JeJsmz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.15682447126496
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgXDuKPC02thQc2pb02nmD2p9rwC:qgFq30dAL/ixegzuKPYthQHtPnmDq9x
MD5:	551281073A74EBDE58E77DA868154018
SHA1:	D9F70A36E6CC626697EFDA42800B9EF52A027679
SHA-256:	FE0AF28CE780BBC3E45DEB18A92281F053B27BD6757FF159F55366AE1848585F
SHA-512:	D267D718A66F03624A2696877A55DDB3A5F3E52029C1209834C25FF923EA8EAB70B88B73597FBECF29A865343E1211F8E2983694D5B848CC16B9064B0BCC41F5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127M91Rwz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.147791944764235
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgXDuKPC02z5c2zw02zb2owB:qgFq30NzL/ixxTgzuKPYz5HzwPzbA
MD5:	0240E3A65FBAE611A813EEB297F9F18A
SHA1:	F7EF12513A2E4A0C6A09B425FC1025ACA4348ACC
SHA-256:	E389496F75D6F8EADF48EB1587C4DB99DC6A97C3B6E7391C617F0F2F64791603
SHA-512:	AAF847CBC87C3E7E06C92DAF1AAB4ACB33C013F8CEA82769A9FF54DAF924EB514046ED75C98E0B2010D7B3E0D48B3EF38BE2B996E4D66BBB081E6CCA2683592D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127VQDjQC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.15682447126496
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgXDuKPC02thQc2pb02nmD2p9rwC:qgFq30dAL/ixegzuKPYthQHtPnmDq9x
MD5:	551281073A74EBDE58E77DA868154018
SHA1:	D9F70A36E6CC626697EFDA42800B9EF52A027679
SHA-256:	FE0AF28CE780BBC3E45DEB18A92281F053B27BD6757FF159F55366AE1848585F
SHA-512:	D267D718A66F03624A2696877A55DDB3A5F3E52029C1209834C25FF923EA8EAB70B88B73597FBECF29A865343E1211F8E2983694D5B848CC16B9064B0BCC41F5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127lnXN7z

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127m5cnEA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.31786425078408
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBvYfgXDuKPC02thQc2x9sS02/g2owB:qgFq30VuR8L/ibBFIgzuKPYthQHxbPYA
MD5:	95FC53F61D785B1C34C83E7F62DFFEF9
SHA1:	0C007FFA454A4CD1AEC200A249C62423B5B3FFDF
SHA-256:	A7BE71AA15ABE3E10026C797B619BD2DBEC902C3D4AF5BAECBDD5EFF94B7DDC8
SHA-512:	D4FA61F997597FCDFB802A11EB352A2EB480D703E31433649EEBF9FE66D7CCDD268992FEC67D500DA6D5ECC133A7EE13D0DF5E90C30B009869C1940C29772690
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.DISPLAY=c1.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127mzEyMC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.163728199744315
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgXDuKPC02z5c2zw02zb2owB:qgFq30z1cL/ixxTgzuKPYz5HzwPzbA
MD5:	FC0A654928623CC2A76AAFB74C67095A
SHA1:	28CFEC208E267BFC6F3741C0130DEF199A787303
SHA-256:	0854BB3B2C3633BF598BE95FFF378430EB5B194572A85C2D118394F424EBBB02
SHA-512:	E4B8383BD173F863A1D8585CA5A7811CDADE25987F8F5EBC2B71BD770BF8C3E4E780B176FB3F0AE1E44AE2B5165F8B1D4EF44D4B810EACF880813267AB0EC5EA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127oghIzB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.142688236035106
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgXDuKPC02z5c2zw02zb2owB:qgFq30z1cL/iRJgzuKPYz5HzwPzbA
MD5:	DB0535B04D3F1591E0860671441C0E28
SHA1:	EBF06C12B3D67832F5D9942185F31C7D7698E490
SHA-256:	2EF68A5992B2C3FBEF7AF06DFF0080A376664C105265105D5AC597A5C3241A38
SHA-512:	80BEDBE77087C83B15613848D16AC040C5AE9133BEE24A475ED206E6E747E819245056855F0BDF9365B166F6E1864FF1B3FE6F3D2A961E354135755CF1F4D4CE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127wlENwB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.169699200809019
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgXDuKPC02thQc2x9sS02nmD2owC:qgFq30dAL/ixegzuKPYthQHxbPnmDd
MD5:	E79C8FC625B98758B38C7025F69A2B30
SHA1:	421312E4F483F6BFA38722C775B0A0A492C17F87
SHA-256:	7B4490C3D8E2817F3584EDD447F596599FFB33C8065E53C4F764437E9FA92EB1
SHA-512:	F8863796C97804F4F3FF564AEEFE90D79B2D24FD923CFF0F27F06AD0412A7055B2736C6BE2A85EECC6FDE40DABABE41FD64DEF46AD56E68F3EE9649790CC66BE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728923120300727.MONOTONIC=138449575.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:FVj:vj
MD5:	01A643906891616C710CF56CF4A8D17D
SHA1:	D48F759A3810D1723EAC603B52D68D718350DB07
SHA-256:	88E86B88D8D084672D227EFF10E1A2D1F50113F979D0A98B4471EDA282801128
SHA-512:	A0CEC03473FA16D8783A4FE427DA2901C2EB1EC63A0469913FFD93E0D901C8027F60B6BE9D16C8A2F612D7A99D49870478FCC991EBC70BD350D5886D1204D996
Malicious:	false
Preview:	5506.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.009153697696271
Encrypted:	false
SSDEEP:	12:OxPMuJveY+Mu83x3xPL1BY3hUjveY+L1BYZkxPH+rl9NOveY+H+5AxPu3o3ulveP:/GRntGeWyetbFZ9T2E8qXRtQ
MD5:	19001883F11498B11E39D2AEA512DD9D
SHA1:	03BE3EABC690FD2BD4CA80023895BD3B5A72197F
SHA-256:	3ABC77FA748E8D713FE9265062781CB3F55EB2CD7FC16014D6B479237CA1B46F
SHA-512:	FB13AEFB7B35B1F045A6725FB51C66C5F1C7DD3B9DA9A65EED8C233F357F438046F56613974446373124AA30F33AB39DB851BCF85E49ADD384434BA711EEC4EB
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5727..MIT-MAGIC-COOKIE-1../.D....P.'.8,..t..XSMP...#local/galassia:@/tmp/.ICE-unix/5727..MIT-MAGIC-COOKIE-1.....^jr.KP.d.4....ICE...!unix/galassia:/tmp/.ICE-unix/5652..MIT-MAGIC-COOKIE-1...q>..:W....l.$..ICE...#local/galassia:@/tmp/.ICE-unix/5652..MIT-MAGIC-COOKIE-1....e....(v\.O/...XSMP...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....3.16G.\|.Q.......XSMP...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..uoT..;.......%....ICE...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...)....I...b....L..ICE...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1..j...w~q]$M....<...XSMP...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...i...........LE..XSMP...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...e.....-..3$....ICE...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....<..;..6<L.......ICE...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..ad.U~.OxR.c.}..(..XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.0217563256604105
Encrypted:	false
SSDEEP:	3:rg/WFllasO93nQ+AIiDtHNWFllasO93nQ+AIin:rg/WFl239ArxNWFl239Af
MD5:	9AAF5C9A95118DB2862E11E9F4FE6725
SHA1:	286ED049A9F14CC832A72A73657CB49FCF3EB094
SHA-256:	4A175105CA82F18059FFA3D550247A5055B6AA86AF18396BF59F9B605DF16440
SHA-512:	E17D883457A3C1ADB633937EC4943A4A98D011EEEBF688342ABEEBB4BB38AA01EBAC68A4DA92BF976A31D86015853D9298F0B6E60A74A6AF252E54183F716F25
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1..Y...~e......%......galassia....MIT-MAGIC-COOKIE-1..Y...~e......%..

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:tvn:dn
MD5:	18E7B58D69D55D698EB6F87482A55A71
SHA1:	EEEB17CEE223D43AB08A170019F8EA37F4D54EB7
SHA-256:	E407004EFA01CE70FC46743DFEA796492DD511D0DA40EBEEE21607028FA7388A
SHA-512:	4AE2822A2B55C876E4C9D15F0A2FDB593E1D1BC20F99F3EC3D9A431211F32845C28550D65F43008281583444FECEF5FCCF1AD547B59D662D3A0353E824624792
Malicious:	false
Preview:	6013.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018081
Encrypted:	false
SSDEEP:	3:ylSsXlXEWtl/bZjlXl:yh+ylTZj
MD5:	4EF006190E1CDFE8AA45EA74E713954D
SHA1:	101DD5ED03639F12CD9456BC2032C3FD3337186E
SHA-256:	737E80F566EEE2567846AC7B3960574057387C01D04EDDBED9A0E2F7EE5F5EF6
SHA-512:	31BD7D17173CF16EBA9648B7AC48116F479395819F1063A92AFE6A03ABD320BE1E87936DE141AA93D69EC2D74583EB21260F4EBEC55B410FA906C3C54C91D111
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................E.g.M......................................

/tmp/qemu-open.225jpn (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/qemu-open.MSCdZQ (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.8GQ6U2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.D9GGV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.1820752875026805
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWWRvlFH5Q4l:q5sU3LWfLUDmQymqSFbfomS6pPfNv
MD5:	592DDF77AC7C1ADBC72B4CD8E77B19A8
SHA1:	30514502BD37D451EA7918248BA079218A3D9B1D
SHA-256:	E0520037A50267BD93BAF70752AC85E6498674E189F0D2ECA62C3ED755CEFD2D
SHA-512:	28275ADF5C03EC91B4D2143FB7157E1229A8F559196937AB638A797415A2F946922EECC5DEED15D5B79A3A48A49E2339BDAD978552BE55046DD16EC2FE861E9D
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-ckSXGUQF,guid=c509d363af2f76fd8e419a7c670d4625.IBUS_DAEMON_PID=5957.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.287192295027188
Encrypted:	false
SSDEEP:	384:Rx9mMWSAMYdGd8dMdUdWdtdldmdsdAdDdsdvdAdndqdmd0dudJdTndSBda3dxdmy:X9m7UemksByUoOcnqr2CfoiKZdP
MD5:	2E1848D478B78FF4C29656C7ACB25311
SHA1:	5B41158C91B1AA08D9B662547A0BA878D5DA46D0
SHA-256:	52E5EB3F08373198EE49917B54127616065E18D3F4133993CD9B21836FF344DE
SHA-512:	C0E7F5D29FA5F4231CA2A6E9CD1B524B4EC6C9750F6D811AAC126D25CE869F7F61AEF0B0254F0B86258B2047DA16FF715F1B8EB80C5C863FE617038B3C8AF9BD
Malicious:	false
Preview:	[ 150.417] (--) Log file renamed from "/var/log/Xorg.pid-5709.log" to "/var/log/Xorg.0.log".[ 150.444] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 150.456] Build Operating System: linux Ubuntu.[ 150.464] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 150.472] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 150.496] Build Date: 06 July 2021 10:17:51AM.[ 150.507] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 150.519] Current version of pixman: 0.38.4.[ 150.533] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 150.538] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.967133273110751
Encrypted:	false
SSDEEP:	24:oRZ4yRZe3qYrqgJqgU0/kAvckA2+Vvsq47PmVrCQeW6PBFdxPpmEdcXju6NuDUra:CBDkvIfVJSgrCqCaODUrbomrCn
MD5:	CD248F66C772067F81A49C5CA3509EBF
SHA1:	AB8AA6FF79BDAE006DEB2A57590953953F991A2E
SHA-256:	B3037F20D7421E9B529688722E79170B36DD242874926D97B0AA2F0FD323F590
SHA-512:	41B8E6541E5AF54F11F037161913DADE1035859BB3F8607311D673491B03C10D5A6675DDC82745B2A0AB99C906694270BAFE69107FEF4681C4D40CD658C6D6A7
Malicious:	false
Preview:	Oct 14 11:24:59 galassia systemd-logind[5520]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 14 11:24:59 galassia systemd-logind[5520]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 14 11:24:59 galassia systemd-logind[5520]: User enumeration failed: Invalid argument.Oct 14 11:24:59 galassia systemd-logind[5520]: User of session c2 not known..Oct 14 11:24:59 galassia systemd-logind[5520]: User of session 2 not known..Oct 14 11:24:59 galassia systemd-logind[5520]: Session enumeration failed: No such file or directory.Oct 14 11:24:59 galassia systemd-logind[5520]: Watching system buttons on /dev/input/event0 (Power Button).Oct 14 11:24:59 galassia systemd-logind[5520]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Oct 14 11:25:00 galassia systemd-logind[5520]: New seat seat0..Oct 14 11:25:00 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Oct 14 11:25:00 ga

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	42688
Entropy (8bit):	4.725072263343626
Encrypted:	false
SSDEEP:	384:0Bt0k060b0Y0C0x0t0TEDGSIOWIrci1cERwjq:030k060b0Y0C0x0t0orWIZRw2
MD5:	2BC7B900BAD02908C0521CF5FF972499
SHA1:	DD207180CF236DDA619EFFD33536E98591B0D19C
SHA-256:	5CB1EFBBA17765A51184A0F9BC299E2E1175E4AA78B6F034A56D5212BC7138B7
SHA-512:	D9130E7EEDDC4218FED41AAD9A704B1559AC7D4A92F0AA5ACC1ABC56B83E727431E857B474B62A3FEF1D458FCE758CD880328268D27D9C90C6572B5322B585FC
Malicious:	false
Preview:	Oct 14 11:24:57 galassia kernel: [ 114.496956] blocking signal 9: 5451 -> 778.Oct 14 11:24:57 galassia kernel: [ 114.957967] blocking signal 9: 5451 -> 936.Oct 14 11:24:57 galassia kernel: [ 115.036232] blocking signal 9: 5451 -> 1400.Oct 14 11:24:57 galassia kernel: [ 115.185857] blocking signal 9: 5451 -> 1805.Oct 14 11:24:57 galassia kernel: [ 115.288794] blocking signal 9: 5451 -> 3069.Oct 14 11:24:57 galassia kernel: [ 115.338356] blocking signal 9: 5451 -> 3132.Oct 14 11:24:57 galassia kernel: [ 115.750632] New task spawned: old: (tgid 5507, tid 5507), new (tgid: 5507, tid: 5513).Oct 14 11:24:57 galassia kernel: [ 115.750919] New task spawned: old: (tgid 5507, tid 5507), new (tgid: 5507, tid: 5514).Oct 14 11:24:57 galassia kernel: [ 115.757269] New task spawned: old: (tgid 5507, tid 5513), new (tgid: 5507, tid: 5515).Oct 14 11:24:57 galassia kernel: [ 116.141390] blocking signal 9: 5457 -> 660.Oct 14 11:24:57 galassia kernel: [ 116.247653] blocking signal 9: 5457 -> 72

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	157107
Entropy (8bit):	5.219374747169899
Encrypted:	false
SSDEEP:	3072:ayCVJUNU8UdUrUPUaUZUEUWUnUyUnU3UpUTUFUOUgU/UoUvUj:L4UNU8UdUrUPUaUZUEUWUnUyUnU3UpUn
MD5:	C9F9391C4281A86118FB7718610E2C29
SHA1:	381FD5FA7F09BD48413CB0A7DA11C486D4C26DC3
SHA-256:	6CB01CD465103D5A7BC654FCB8DD5AF67D7FCF9EF4C7709F71579EF61888C175
SHA-512:	35ED120D90D70ADC7E82C855003E7D899E44F81A2B41AD329D2A5B2D8D6A6EBECFBB90D747B2ED47D6D95FE2D2936F0E14F8C59FDAA413E5EF811D4262F67A46
Malicious:	false
Preview:	Oct 14 11:24:56 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 14 11:24:56 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 14 11:24:56 galassia systemd[2935]: pulseaudio.service: Scheduled restart job, restart counter is at 1..Oct 14 11:24:56 galassia systemd[2935]: Stopped Sound Service..Oct 14 11:24:56 galassia systemd[2935]: Starting Sound Service....Oct 14 11:24:56 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Oct 14 11:24:56 galassia systemd[1]: Stopped System Logging Service..Oct 14 11:24:56 galassia systemd[1]: Starting System Logging Service....Oct 14 11:24:56 galassia systemd[1410]: dbus.service: Main process exited, code=killed, status=9/KILL.Oct 14 11:24:56 galassia systemd[1410]: dbus.service: Failed with result 'signal'..Oct 14 11:24:56 galassia tumblerd[3182]: Name org.freedesktop.thumbnails.Cache1 lost on the message dbus, exiting..Oct 14 11:24:56 galassia tumblerd[3

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018081
Encrypted:	false
SSDEEP:	3:ylSsXlXEWtl/bZjlXl:yh+ylTZj
MD5:	4EF006190E1CDFE8AA45EA74E713954D
SHA1:	101DD5ED03639F12CD9456BC2032C3FD3337186E
SHA-256:	737E80F566EEE2567846AC7B3960574057387C01D04EDDBED9A0E2F7EE5F5EF6
SHA-512:	31BD7D17173CF16EBA9648B7AC48116F479395819F1063A92AFE6A03ABD320BE1E87936DE141AA93D69EC2D74583EB21260F4EBEC55B410FA906C3C54C91D111
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................E.g.M......................................

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.99214982930538
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	145'644 bytes
MD5:	69ab287c2939c64aa4072b0588a352f3
SHA1:	0f66b046a5043506e09a22455f08abf00d1b786f
SHA256:	e99e50a2be865c6418ccadfb91ec6e5fe04557ddb29e6e4c18a2c8af307a807b
SHA512:	7c05b5cfab33e9a7610cd9fbea12b0e5247c00478eb56816322c36ded34cd835df9108d529f7365dc93f20ed3fb1c4295337fd8825aaa9d9b57a06216fa8aeb6
SSDEEP:	3072:AwXGFHqTAphDoa+SlaK30LpGOaLhoWKKj255M/9W9ugLH+:bXyHqcvoa+SlaKElqbvj23M/9ku+H+
TLSH:	57E33B56EB814B13C0D6177ABAAF414533239B64D3DB73069928BFB43F8675E0E23605
File Content Preview:	.ELF..............(.........4...........4. ...(........p.R...........................................S...S...............S...S...S..`....3...............S...S...S..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	114352
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x13b64	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1bc54	0x13c54	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1bc68	0x13c68	0x1658	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1d2c0	0x152c0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1d2d8	0x152d8	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x253f0	0x153f0	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x253f4	0x153f4	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x253f4	0x153f4	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x253f8	0x153f8	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x253fc	0x153fc	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x25400	0x15400	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x254a8	0x154a8	0x2a8	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x25750	0x15750	0x3064	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x15750	0xad8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x16228	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x16368	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1657b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x185be	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x18ca0	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x19b18	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x19dd0	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1a69a	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1b829	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1bd81	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1bd97	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1c338	0x4d80	0x10	0x0		28	702	4
.strtab	STRTAB	0x0	0x210b8	0x2834	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x152d8	0x1d2d8	0x1d2d8	0x118	0x118	4.4290	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x153f0	0x153f0	6.1267	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x153f0	0x253f0	0x253f0	0x360	0x33c4	3.5424	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x153f4	0x253f4	0x253f4	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 14, 2024 18:24:54.843729973 CEST	192.168.2.13	8.8.8.8	0x74ff	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 14, 2024 18:24:57.834566116 CEST	192.168.2.13	8.8.8.8	0x9890	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 14, 2024 18:24:55.114373922 CEST	8.8.8.8	192.168.2.13	0x74ff	No error (0)	byte-mirai.kro.kr		154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 14, 2024 18:24:57.843086958 CEST	8.8.8.8	192.168.2.13	0x9890	No error (0)	byte-mirai.kro.kr		154.216.20.119	A (IP address)	IN (0x0001)	false

Start time (UTC):	16:24:53
Start date (UTC):	14/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	16:24:54
Start date (UTC):	14/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	16:24:56
Start date (UTC):	14/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:24:58
Start date (UTC):	14/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:24:59
Start date (UTC):	14/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:25:00
Start date (UTC):	14/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:25:01
Start date (UTC):	14/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:25:02
Start date (UTC):	14/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	16:25:03
Start date (UTC):	14/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:25:04
Start date (UTC):	14/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:25:06
Start date (UTC):	14/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:25:16
Start date (UTC):	14/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:25:17
Start date (UTC):	14/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:25:18
Start date (UTC):	14/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5656/oom_score_adj

/proc/5659/oom_score_adj

/proc/5661/oom_score_adj

/proc/5663/oom_score_adj

/proc/5665/oom_score_adj

/proc/5667/oom_score_adj

/proc/5672/oom_score_adj

/proc/5743/oom_score_adj

/proc/5771/oom_score_adj

/proc/5774/oom_score_adj

/proc/5776/oom_score_adj

/proc/5778/oom_score_adj

/proc/5780/oom_score_adj

/proc/5782/oom_score_adj

/proc/5787/oom_score_adj

/proc/5967/oom_score_adj

/proc/6124/oom_score_adj

/proc/6140/oom_score_adj

/proc/6358/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1rJNMXy

/run/systemd/inhibit/.#2GaFvMB

/run/systemd/inhibit/.#33Oj20y

/run/systemd/inhibit/.#4lH7iFB

/run/systemd/inhibit/.#5q8ZvoB

Linux Analysis Report
na.elf

Start time (UTC):	16:25:20
Start date (UTC):	14/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	16:25:21
Start date (UTC):	14/10/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	16:25:23
Start date (UTC):	14/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	16:25:24
Start date (UTC):	14/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	16:25:22
Start date (UTC):	14/10/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	16:25:25
Start date (UTC):	14/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	16:25:29
Start date (UTC):	14/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:25:31
Start date (UTC):	14/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	16:25:32
Start date (UTC):	14/10/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	16:25:42
Start date (UTC):	14/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8