Linux Analysis Report
vqsjh4.elf

Overview

General Information

Sample name:	vqsjh4.elf
Analysis ID:	1560604
MD5:	cbe293c20f35d924a4db7bbc4a2019bc
SHA1:	ae5972538150e47965fc690d03a8b4f6bfa2ba12
SHA256:	7ee2658dadda272b56464d8400700bed1338707ab1a6b65c83d0d6dbf6f619d3
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: vqsjh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: vqsjh4.elf	ReversingLabs: Detection: 39%
Source: vqsjh4.elf	Virustotal: Detection: 38%			Perma Link

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/ps (PID: 5596)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 5974)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5738)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5836)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5881)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5980)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/lib/xorg/Xorg (PID: 6070)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6021)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6181)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6189)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/lib/xorg/Xorg (PID: 6263)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6302)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 6341)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Found strings indicative of a multi-platform dropper

Source: vqsjh4.elf

String: AEOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: ksdjwi.eye-network.ru. [malformed]

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.13:44728 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.13:49802 -> 154.216.16.109:33966

Reads the 'hosts' file potentially containing internal network hosts

Source: /usr/sbin/rsyslogd (PID: 5739)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5859)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5886)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5953)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6157)	Reads hosts file: /etc/hosts

Sample listens on a socket

Source: /lib/systemd/systemd-journald (PID: 5719)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5990)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6030)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 6032)	Socket: unknown address family
Source: /usr/lib/xorg/Xorg (PID: 6070)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6087)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6013)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6155)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6203)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6227)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 6228)	Socket: unknown address family
Source: /usr/lib/xorg/Xorg (PID: 6263)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6280)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6301)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 6281)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 6492)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru. [malformed]

Source: Xorg.0.log.447.dr, syslog.328.dr, syslog.169.dr, Xorg.0.log.299.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.447.dr, syslog.328.dr, syslog.169.dr, Xorg.0.log.299.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.115.dr, syslog.159.dr, syslog.45.dr, syslog.328.dr, syslog.169.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: vqsjh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5426.1.00007f61fc400000.00007f61fc41f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: vqsjh4.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 490, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 508, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 518, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 519, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 659, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 765, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 792, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 793, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 802, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 803, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 816, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 855, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 914, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 917, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3697, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5434, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 508, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 518, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 519, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 659, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 792, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 793, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 802, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 803, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 816, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 855, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 914, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 917, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1400, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1410, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1411, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1432, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1444, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1804, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1832, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1969, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2926, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2961, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2964, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2972, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2974, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2984, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3069, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3110, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3114, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3134, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3146, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3147, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3153, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3158, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3161, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3162, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3163, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3164, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3165, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3170, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3181, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3183, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3185, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3203, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3208, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3212, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3220, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3225, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3246, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3310, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3315, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3336, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3342, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3375, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3413, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3424, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3434, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3448, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3633, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3708, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3764, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5218, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5373, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5412, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5413, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5439, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5441, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5442, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5443, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5444, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5445, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5446, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5447, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5448, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5449, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5450, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5451, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5452, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5453, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5454, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5455, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5456, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5457, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5458, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5590, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5591, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5594, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5596, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5728, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5738, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5739, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5809, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5858, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5859, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5719, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5743, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5884, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5885, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5729, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5891, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5894, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5951, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5952, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5953, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5972, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5974, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5990, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6024, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6092, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6093, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6154, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6280)	SIGKILL sent: pid: 6295, result: successful

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3697, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5434, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 508, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 518, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 519, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 659, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 792, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 793, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 802, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 803, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 816, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 855, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 914, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 917, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1400, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1410, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1411, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1432, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1444, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1804, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1832, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1969, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2926, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2961, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2964, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2972, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2974, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2984, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3069, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3110, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3114, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3134, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3146, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3147, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3153, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3158, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3161, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3162, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3163, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3164, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3165, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3170, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3181, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3183, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3185, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3203, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3208, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3212, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3220, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3225, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3246, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3310, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3315, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3336, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3342, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3375, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3413, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3424, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3434, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3448, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3633, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3708, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3764, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5218, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5373, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5412, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5413, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5439, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5441, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5442, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5443, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5444, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5445, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5446, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5447, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5448, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5449, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5450, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5451, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5452, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5453, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5454, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5455, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5456, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5457, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5458, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5590, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5591, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5594, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5596, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5728, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5738, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5739, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5809, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5858, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5859, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5719, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5743, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5884, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5885, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5729, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5891, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5894, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5951, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5952, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5953, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5972, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5974, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5990, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6024, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6092, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6093, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6154, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6280)	SIGKILL sent: pid: 6295, result: successful

Yara signature match

Source: vqsjh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5426.1.00007f61fc400000.00007f61fc41f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: vqsjh4.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/245@66/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5728)	File: /proc/5728/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5829)	File: /proc/5829/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5952)	File: /proc/5952/mounts
Source: /usr/bin/dbus-daemon (PID: 6030)	File: /proc/6030/mounts
Source: /usr/bin/dbus-daemon (PID: 6087)	File: /proc/6087/mounts
Source: /usr/bin/dbus-daemon (PID: 6024)	File: /proc/6024/mounts
Source: /usr/bin/dbus-daemon (PID: 6222)	File: /proc/6222/mounts
Source: /usr/bin/dbus-daemon (PID: 6156)	File: /proc/6156/mounts
Source: /usr/bin/dbus-daemon (PID: 6188)	File: /proc/6188/mounts
Source: /usr/bin/dbus-daemon (PID: 6227)	File: /proc/6227/mounts
Source: /usr/bin/dbus-daemon (PID: 6280)	File: /proc/6280/mounts
Source: /usr/bin/dbus-daemon (PID: 6301)	File: /proc/6301/mounts
Source: /usr/bin/gnome-shell (PID: 6341)	File: /proc/6341/mounts

Creates hidden files and/or directories

Source: /usr/libexec/gsd-rfkill (PID: 5434)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5434)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5439)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:6292388GBwD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:62925wCQ3jC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:63083NzRQXC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:63098z9NdlE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:63273f4ztlC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:633713aVsyC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:63406GyvirF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:64678MvfFpD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:65729BdS3jG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:6582174yFfE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:65909ooLrAF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:66005tEG3YB	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:66124UkKYNF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:662974gcYCD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:66382pKA9mF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5743)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5743)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5743)	File: /run/systemd/seats/.#seat0C6DGSs	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5805)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5849)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67066WCv40C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67067mrUnJF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67068VxdrmC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67083f6vI9C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67084FAbgGG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:670857Uuj8E	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67163UCC0JC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67165fvqDFE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67255HqwMDF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67685ebVStE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67388MRnhhD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67390XdSkJG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67499wYL8SD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67742XBPJRC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67766wJIxPE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67772WfmdCE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:677744LDODG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:677753oXkQC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:678198AFzEE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67827TfCy0C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:68896NA9nrD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:68992rvjzKE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:68994EZyMyE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:690391rf9zF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:690414LrkhF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:69120bKq4zD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:691224aZcpF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:69172aqWHAG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0qo3flR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127kn7ErR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127mxegtQ
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0gAYdcR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127S4z9kS
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1zafapS
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127grA2PT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat00JqDaT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127VQf0rQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1Pff3ES
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1Wpk6zT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127lFXjqT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1OBsUtS
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1m5rrWT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c18SIFsQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#1275vbE7R
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0Vo4IeQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127joqvGU
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat01yPdhQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127Ciz0UQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0OiT4OR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127ZbY85Q
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c28ShBAS
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#1271z7ZcU
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0tDoKYR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2tyJuoT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c21ja5uU
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127qdw6VQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2WsBGAR
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2owUsEU
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2bZnxkR
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2toy01R
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (24)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2DoAHfS
Source: /usr/bin/gnome-shell (PID: 6055)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6055)	Directory: <invalid fd (10)>/..
Source: /usr/lib/xorg/Xorg (PID: 6070)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 6070)	Directory: <invalid fd (22)>/..
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6003)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6016)	Directory: <invalid fd (4)>/.config
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (5)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (4)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat08ICyhc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127C6CMag
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127m32PNf
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat00VLW6c
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127vmUZMe
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1A4HcZc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127ncdj1c
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat001gstd
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127zYpbOc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1PjuARe
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1JO8TTe
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127m2dojg
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1isnEQc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1DjPMHd
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1E2msjg
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127FW9IAc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat0dNVZUd
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127nNTceg
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat0VUL7Wd
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127wmkYZc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat0sUhoHf
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127a0De9f
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2ntO00e
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127SPslXb
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat0fTNP1f
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2dUm8Yf
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c257I38b
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127BCHpzf
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2y7pySd
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2f8pfOd
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2dBL4Kf
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2sWN4ud
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (24)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2YSjhec
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70077KhCX2B
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:700787A6YeE
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70081WXBUPB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70082xDlWwD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70093frtu4z
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:701004sozdB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70101D85c1z
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:701021h9J8D
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70697218Y3C
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70709nS1JMz
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:707158EEO6B
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70308YivxQC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70433CvqNNC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70521OHR7cD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:709265YWBcE
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70927gTEczD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:709567wXMOD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70957GDjXKz
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70997whIuQz
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71046U4QmYD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71089rlFdLC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71090mvzfGC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71123dNbXTB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71124TfX9AD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71192L7qVnB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71193nQBGlB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71360V5vz0A
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71600cPVQbC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71601csgg7D
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:720680dMBTC
Source: /usr/lib/policykit-1/polkitd (PID: 6193)	Directory: /root/.cache
Source: /usr/bin/gnome-shell (PID: 6248)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6248)	Directory: <invalid fd (10)>/..
Source: /usr/lib/xorg/Xorg (PID: 6263)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 6263)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6302)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: <invalid fd (13)>/..
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	Directory: /root/.cache

Enumerates processes within the "proc" file system

Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/cgroup

Executes commands using a shell command-line interpreter

Source: /tmp/vqsjh4.elf (PID: 5594)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5972)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5812)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5817)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5819)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5822)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5824)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5826)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5828)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5833)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5855)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5864)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5866)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5868)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5870)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5872)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5874)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5876)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5878)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5958)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5960)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5962)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5964)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5966)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5968)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5970)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5975)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/lib/xorg/Xorg (PID: 6079)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 6000)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6162)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6164)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6168)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6170)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6172)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6174)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6176)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6178)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/lib/xorg/Xorg (PID: 6272)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6499)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 6213)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5816)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5818)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5820)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5823)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5825)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5827)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5830)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5834)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5857)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 5865)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5867)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5869)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5871)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5873)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5875)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5877)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5879)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5959)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5961)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5963)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5965)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5967)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5969)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5971)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5976)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6002)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6163)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6165)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6169)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6171)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6173)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6175)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6177)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6179)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6215)	Grep executable: /usr/bin/grep -> grep -F .utf8

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /usr/share/gdm/generate-config (PID: 5836)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5881)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5980)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6181)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Executes the "ps" command used to list the status of processes

Source: /bin/sh (PID: 5596)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 5974)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Executes the "rm" command used to delete files or directories

Source: /usr/bin/dash (PID: 5588)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IkyvwMlTMD /tmp/tmp.ZjrrwLIcUA /tmp/tmp.zzdJNYn8ox			Jump to behavior
Source: /usr/bin/dash (PID: 5589)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IkyvwMlTMD /tmp/tmp.ZjrrwLIcUA /tmp/tmp.zzdJNYn8ox			Jump to behavior

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /lib/systemd/systemd (PID: 6020)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Reads system information from the proc file system

Source: /usr/bin/ps (PID: 5596)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 5974)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6155)	Reads from proc file: /proc/meminfo

Reads system version information

Source: /sbin/agetty (PID: 5809)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5858)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5951)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6094)	Reads version info: /etc/issue

Sample tries to set the executable flag

Source: /usr/sbin/gdm3 (PID: 5845)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5845)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5849)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5849)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5990)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 5990)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/bin/pulseaudio (PID: 6021)	File: /run/user/127/pulse (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 6203)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6203)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5739)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5739)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5811)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5859)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5863)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5886)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5953)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5953)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5954)	Log file created: /var/log/gpu-manager.log
Source: /usr/lib/xorg/Xorg (PID: 6070)	Log file created: /var/log/Xorg.0.log
Source: /usr/sbin/rsyslogd (PID: 6157)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6157)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6158)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 6263)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/vqsjh4.elf (PID: 5428)

File: /tmp/vqsjh4.elf

Jump to behavior

Deletes log files

Source: /usr/bin/gpu-manager (PID: 5811)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5863)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5954)	Truncated file: /var/log/gpu-manager.log
Source: /usr/lib/xorg/Xorg (PID: 6070)	Truncated file: /var/log/Xorg.pid-6070.log
Source: /usr/bin/gpu-manager (PID: 6158)	Truncated file: /var/log/gpu-manager.log
Source: /usr/lib/xorg/Xorg (PID: 6263)	Truncated file: /var/log/Xorg.pid-6263.log

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/ps (PID: 5596)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 5974)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5738)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5836)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5881)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5980)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/lib/xorg/Xorg (PID: 6070)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6021)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6181)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6189)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/lib/xorg/Xorg (PID: 6263)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6302)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 6341)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/vqsjh4.elf (PID: 5426)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5439)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5738)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5739)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5809)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5811)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5858)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5859)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5863)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5886)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5951)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 5953)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 5954)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6007)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 6032)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6063)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 6068)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 6070)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6089)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6021)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6094)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6155)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6157)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6158)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6189)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6216)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 6228)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6256)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 6261)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 6263)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 6296)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 6281)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6302)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 6341)	Queries kernel information via 'uname':

Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.476] (--) vmware(0): mwidt: 1176
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.848] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.938] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.775] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:20 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.608] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.977] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.056] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 281.984] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.587] (==) vmware(0): Using HW cursor
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.009] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.417] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.643] (--) vmware(0): depth: 24
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.546] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.419] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): w.grn: 8
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.863] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.304] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.364] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.675] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.568] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:45 galassia /usr/lib/gdm3/gdm-x-session[6263]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.510] (--) vmware(0): w.red: 8
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.832] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.943] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.074] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.683] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.216] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.578] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.374] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.647] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.066] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.348] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.710] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.099] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.023] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.409] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.043] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.120] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.436] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.692] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.098] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.198] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.843] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.203] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.737] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.401] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.083] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.811] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.736] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.855] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.207] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.806] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.657] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.164] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.758] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.091] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 278.755] (II) LoadModule: "vmware"
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.900] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.110] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 278.790] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.845] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.891] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.528] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.924] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.854] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.930] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.854] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.745] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.019] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.863] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.666] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.770] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.830] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.572] (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.607] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.374] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.016] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.820] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.735] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.845] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.485] (--) vmware(0): mheig: 885
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.256] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.181] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.990] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.872] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.971] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.010] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.881] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.082] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.773] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.165] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.789] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.294] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 281.923] (EE) vmware(0): Failed to open drm.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.110] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.464] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.722] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.545] (--) vmware(0): vis: 4
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:55 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) LoadModule: "vmware"
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.517] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.241] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.649] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.035] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.550] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.086] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.086] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.024] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.684] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.017] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.486] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.502] (--) vmware(0): bpp: 32
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.613] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.108] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.996] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.412] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.155] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.438] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.392] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.303] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.663] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.810] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.647] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.875] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.121] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.405] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.856] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.101] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.564] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.283] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.468] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.578] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.980] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.393] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.007] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.132] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.285] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.225] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.308] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.798] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:46 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.793] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.231] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: vqsjh4.elf, 5426.1.00007ffe3cfdf000.00007ffe3d000000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.fDts8u\
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (==) vmware(0): Silken mouse enabled
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.477] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.699] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.424] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.355] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.172] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.802] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.365] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.242] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.475] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.149] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.575] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.367] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.357] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.330] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.638] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 279.366] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.344] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.123] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.493] (--) vmware(0): depth: 24
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.726] (==) vmware(0): Using HW cursor
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.487] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.241] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.707] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.668] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.889] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.469] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.855] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.938] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:07 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.937] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.922] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.717] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.612] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.229] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.750] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.901] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.092] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.729] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.051] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.055] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 279.144] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.896] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.709] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.222] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.597] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.306] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.697] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.326] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.672] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:45 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.597] (--) vmware(0): bpp: 32
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.447.dr	Binary or memory string: [ 281.940] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.656] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.828] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:46 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.764] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.781] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.758] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:07 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.190] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.631] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.035] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.294] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.756] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.804] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.669] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.492] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.850] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.928] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.322] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.419] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.285] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.176] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.622] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.106] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.454] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 281.963] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.497] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.012] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.500] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.449] (--) vmware(0): bpp: 32
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.910] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.065] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.784] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.816] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.058] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.876] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.737] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.537] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.891] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.639] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.585] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.791] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.237] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.054] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:55 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.505] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.540] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.471] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.659] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.727] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.281] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: vqsjh4.elf, 5426.1.00007ffe3cfdf000.00007ffe3d000000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.801] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.614] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.191] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.873] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.627] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.157] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.717] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.007] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.969] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.197] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:07 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.146] (==) vmware(0): DPI set to (96, 96)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.820] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.071] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.952] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.676] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): vis: 4
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.449] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.672] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): w.blu: 8
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.119] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.708] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.111] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.594] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.211] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.189] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.490] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.061] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.254] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 246.962] (II) vmware(0): Terminating Xv video-stream id:0
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.256] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.160] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.134] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.864] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.685] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.963] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.139] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.121] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.971] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.210] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.883] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.044] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.981] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.942] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.237] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.203] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.536] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.716] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.612] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.607] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.444] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.086] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.073] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.761] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.150] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.945] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.466] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.753] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.826] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.584] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.678] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.254] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.084] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.312] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.457] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (WW) vmware(0): Disabling 3D support.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.864] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.217] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.095] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.557] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.990] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.784] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5849)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: vqsjh4.elf, type: SAMPLE
Source: Yara match	File source: 5426.1.00007f61fc400000.00007f61fc41f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vqsjh4.elf PID: 5426, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: vqsjh4.elf, type: SAMPLE
Source: Yara match	File source: 5426.1.00007f61fc400000.00007f61fc41f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vqsjh4.elf PID: 5426, type: MEMORYSTR

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom	41231	CANONICAL-ASGB	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
154.216.16.109	ksdjwi.eye-network.ru	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
34.243.160.129	unknown	United States	16509	AMAZON-02US	false

Contacted Domains

Name	IP	Active
ksdjwi.eye-network.ru	154.216.16.109	true
ksdjwi.eye-network.ru. [malformed]	unknown	unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: vqsjh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: vqsjh4.elf	ReversingLabs: Detection: 39%
Source: vqsjh4.elf	Virustotal: Detection: 38%			Perma Link

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/ps (PID: 5596)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 5974)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5738)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5836)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5881)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5980)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/lib/xorg/Xorg (PID: 6070)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6021)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6181)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6189)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/lib/xorg/Xorg (PID: 6263)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6302)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 6341)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Found strings indicative of a multi-platform dropper

Source: vqsjh4.elf

String: AEOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: ksdjwi.eye-network.ru. [malformed]

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.13:44728 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.13:49802 -> 154.216.16.109:33966

Reads the 'hosts' file potentially containing internal network hosts

Source: /usr/sbin/rsyslogd (PID: 5739)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5859)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5886)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5953)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6157)	Reads hosts file: /etc/hosts

Sample listens on a socket

Source: /lib/systemd/systemd-journald (PID: 5719)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5990)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6030)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 6032)	Socket: unknown address family
Source: /usr/lib/xorg/Xorg (PID: 6070)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6087)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6013)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6155)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6203)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6227)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 6228)	Socket: unknown address family
Source: /usr/lib/xorg/Xorg (PID: 6263)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6280)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6301)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 6281)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 6492)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru. [malformed]

Source: Xorg.0.log.447.dr, syslog.328.dr, syslog.169.dr, Xorg.0.log.299.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.447.dr, syslog.328.dr, syslog.169.dr, Xorg.0.log.299.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.115.dr, syslog.159.dr, syslog.45.dr, syslog.328.dr, syslog.169.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: vqsjh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5426.1.00007f61fc400000.00007f61fc41f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: vqsjh4.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 490, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 508, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 518, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 519, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 659, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 765, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 792, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 793, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 802, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 803, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 816, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 855, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 914, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 917, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3697, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5434, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 508, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 518, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 519, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 659, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 792, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 793, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 802, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 803, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 816, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 855, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 914, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 917, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1400, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1410, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1411, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1432, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1444, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1804, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1832, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1969, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2926, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2961, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2964, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2972, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2974, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2984, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3069, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3110, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3114, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3134, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3146, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3147, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3153, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3158, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3161, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3162, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3163, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3164, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3165, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3170, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3181, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3183, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3185, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3203, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3208, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3212, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3220, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3225, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3246, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3310, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3315, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3336, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3342, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3375, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3413, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3424, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3434, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3448, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3633, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3708, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3764, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5218, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5373, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5412, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5413, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5439, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5441, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5442, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5443, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5444, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5445, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5446, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5447, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5448, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5449, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5450, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5451, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5452, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5453, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5454, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5455, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5456, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5457, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5458, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5590, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5591, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5594, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5596, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5728, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5738, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5739, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5809, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5858, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5859, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5719, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5743, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5884, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5885, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5729, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5891, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5894, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5951, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5952, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5953, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5972, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5974, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5990, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6024, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6092, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6093, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6154, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6280)	SIGKILL sent: pid: 6295, result: successful

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3697, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5434, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 508, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 518, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 519, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 659, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 792, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 793, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 802, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 803, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 816, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 855, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 914, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 917, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1400, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1410, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1411, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1432, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1444, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1804, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1832, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 1969, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2926, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2961, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2964, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2972, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2974, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 2984, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3069, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3110, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3114, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3134, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3146, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3147, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3153, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3158, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3161, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3162, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3163, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3164, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3165, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3170, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3181, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3183, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3185, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3203, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3208, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3212, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3220, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3225, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3246, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3310, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3315, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3336, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3342, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3375, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3413, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3424, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3434, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3448, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3633, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3708, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 3764, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5218, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5268, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5373, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5412, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5413, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5439, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5441, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5442, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5443, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5444, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5445, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5446, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5447, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5448, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5449, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5450, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5451, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5452, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5453, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5454, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5455, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5456, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5457, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5458, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5590, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5591, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5594, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5596, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5728, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5738, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5739, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5809, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5858, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5859, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5719, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5743, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5884, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5885, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5729, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5891, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5894, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5951, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5952, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5953, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5972, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5974, result: no such process	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 5990, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6024, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6092, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6093, result: successful	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5430)	SIGKILL sent: pid: 6154, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6280)	SIGKILL sent: pid: 6295, result: successful

Yara signature match

Source: vqsjh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5426.1.00007f61fc400000.00007f61fc41f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: vqsjh4.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/245@66/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5728)	File: /proc/5728/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5829)	File: /proc/5829/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5952)	File: /proc/5952/mounts
Source: /usr/bin/dbus-daemon (PID: 6030)	File: /proc/6030/mounts
Source: /usr/bin/dbus-daemon (PID: 6087)	File: /proc/6087/mounts
Source: /usr/bin/dbus-daemon (PID: 6024)	File: /proc/6024/mounts
Source: /usr/bin/dbus-daemon (PID: 6222)	File: /proc/6222/mounts
Source: /usr/bin/dbus-daemon (PID: 6156)	File: /proc/6156/mounts
Source: /usr/bin/dbus-daemon (PID: 6188)	File: /proc/6188/mounts
Source: /usr/bin/dbus-daemon (PID: 6227)	File: /proc/6227/mounts
Source: /usr/bin/dbus-daemon (PID: 6280)	File: /proc/6280/mounts
Source: /usr/bin/dbus-daemon (PID: 6301)	File: /proc/6301/mounts
Source: /usr/bin/gnome-shell (PID: 6341)	File: /proc/6341/mounts

Creates hidden files and/or directories

Source: /usr/libexec/gsd-rfkill (PID: 5434)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5434)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5439)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:6292388GBwD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:62925wCQ3jC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:63083NzRQXC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:63098z9NdlE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:63273f4ztlC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:633713aVsyC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:63406GyvirF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:64678MvfFpD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:65729BdS3jG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:6582174yFfE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:65909ooLrAF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:66005tEG3YB	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:66124UkKYNF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:662974gcYCD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	File: /run/systemd/journal/streams/.#9:66382pKA9mF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5743)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5743)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5743)	File: /run/systemd/seats/.#seat0C6DGSs	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5805)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5849)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67066WCv40C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67067mrUnJF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67068VxdrmC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67083f6vI9C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67084FAbgGG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:670857Uuj8E	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67163UCC0JC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67165fvqDFE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67255HqwMDF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67685ebVStE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67388MRnhhD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67390XdSkJG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67499wYL8SD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67742XBPJRC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67766wJIxPE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67772WfmdCE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:677744LDODG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:677753oXkQC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:678198AFzEE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:67827TfCy0C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:68896NA9nrD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:68992rvjzKE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:68994EZyMyE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:690391rf9zF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:690414LrkhF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:69120bKq4zD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:691224aZcpF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	File: /run/systemd/journal/streams/.#9:69172aqWHAG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0qo3flR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127kn7ErR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127mxegtQ
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0gAYdcR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127S4z9kS
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1zafapS
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127grA2PT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat00JqDaT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127VQf0rQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1Pff3ES
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1Wpk6zT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127lFXjqT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1OBsUtS
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c1m5rrWT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c18SIFsQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#1275vbE7R
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0Vo4IeQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127joqvGU
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat01yPdhQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127Ciz0UQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0OiT4OR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127ZbY85Q
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c28ShBAS
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#1271z7ZcU
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat0tDoKYR
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2tyJuoT
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c21ja5uU
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/users/.#127qdw6VQ
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2WsBGAR
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2owUsEU
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2bZnxkR
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2toy01R
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (24)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/sessions/.#c2DoAHfS
Source: /usr/bin/gnome-shell (PID: 6055)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6055)	Directory: <invalid fd (10)>/..
Source: /usr/lib/xorg/Xorg (PID: 6070)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 6070)	Directory: <invalid fd (22)>/..
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6003)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6013)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6016)	Directory: <invalid fd (4)>/.config
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (5)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (4)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat08ICyhc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127C6CMag
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127m32PNf
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat00VLW6c
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127vmUZMe
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1A4HcZc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127ncdj1c
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat001gstd
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127zYpbOc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1PjuARe
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1JO8TTe
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127m2dojg
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1isnEQc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1DjPMHd
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c1E2msjg
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127FW9IAc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat0dNVZUd
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127nNTceg
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat0VUL7Wd
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127wmkYZc
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat0sUhoHf
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127a0De9f
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2ntO00e
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127SPslXb
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/seats/.#seat0fTNP1f
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2dUm8Yf
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c257I38b
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/users/.#127BCHpzf
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2y7pySd
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2f8pfOd
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2dBL4Kf
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2sWN4ud
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (24)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 6097)	File: /run/systemd/sessions/.#c2YSjhec
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70077KhCX2B
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:700787A6YeE
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70081WXBUPB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70082xDlWwD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70093frtu4z
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:701004sozdB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70101D85c1z
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:701021h9J8D
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70697218Y3C
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70709nS1JMz
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:707158EEO6B
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70308YivxQC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70433CvqNNC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70521OHR7cD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:709265YWBcE
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70927gTEczD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:709567wXMOD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70957GDjXKz
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:70997whIuQz
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71046U4QmYD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71089rlFdLC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71090mvzfGC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71123dNbXTB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71124TfX9AD
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71192L7qVnB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71193nQBGlB
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71360V5vz0A
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71600cPVQbC
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:71601csgg7D
Source: /lib/systemd/systemd-journald (PID: 6155)	File: /run/systemd/journal/streams/.#9:720680dMBTC
Source: /usr/lib/policykit-1/polkitd (PID: 6193)	Directory: /root/.cache
Source: /usr/bin/gnome-shell (PID: 6248)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6248)	Directory: <invalid fd (10)>/..
Source: /usr/lib/xorg/Xorg (PID: 6263)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 6263)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6302)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 6341)	Directory: <invalid fd (13)>/..
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	Directory: /root/.cache

Enumerates processes within the "proc" file system

Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6097/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6155/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6157/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6256/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6311/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6156/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6013/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6070/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6190/cgroup
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/comm
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/cmdline
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/status
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/attr/current
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/sessionid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/loginuid
Source: /lib/systemd/systemd-journald (PID: 6155)	File opened: /proc/6193/cgroup

Executes commands using a shell command-line interpreter

Source: /tmp/vqsjh4.elf (PID: 5594)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/vqsjh4.elf (PID: 5972)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5812)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5817)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5819)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5822)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5824)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5826)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5828)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5833)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5855)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5864)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5866)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5868)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5870)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5872)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5874)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5876)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5878)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5958)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5960)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5962)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5964)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5966)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5968)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5970)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5975)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/lib/xorg/Xorg (PID: 6079)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 6000)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6162)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6164)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6168)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6170)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6172)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6174)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6176)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6178)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/lib/xorg/Xorg (PID: 6272)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6499)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 6213)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5816)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5818)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5820)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5823)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5825)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5827)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5830)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5834)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5857)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 5865)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5867)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5869)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5871)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5873)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5875)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5877)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5879)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5959)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5961)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5963)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5965)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5967)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5969)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5971)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5976)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6002)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6163)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6165)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6169)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6171)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6173)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6175)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6177)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6179)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6215)	Grep executable: /usr/bin/grep -> grep -F .utf8

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /usr/share/gdm/generate-config (PID: 5836)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5881)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5980)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6181)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Executes the "ps" command used to list the status of processes

Source: /bin/sh (PID: 5596)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 5974)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Executes the "rm" command used to delete files or directories

Source: /usr/bin/dash (PID: 5588)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IkyvwMlTMD /tmp/tmp.ZjrrwLIcUA /tmp/tmp.zzdJNYn8ox			Jump to behavior
Source: /usr/bin/dash (PID: 5589)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IkyvwMlTMD /tmp/tmp.ZjrrwLIcUA /tmp/tmp.zzdJNYn8ox			Jump to behavior

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /lib/systemd/systemd (PID: 6020)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Reads system information from the proc file system

Source: /usr/bin/ps (PID: 5596)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 5974)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6155)	Reads from proc file: /proc/meminfo

Reads system version information

Source: /sbin/agetty (PID: 5809)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5858)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5951)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6094)	Reads version info: /etc/issue

Sample tries to set the executable flag

Source: /usr/sbin/gdm3 (PID: 5845)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5845)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5849)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5849)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5990)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 5990)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/bin/pulseaudio (PID: 6021)	File: /run/user/127/pulse (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 6203)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6203)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5739)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5739)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5811)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5859)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5863)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5886)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5953)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5953)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5954)	Log file created: /var/log/gpu-manager.log
Source: /usr/lib/xorg/Xorg (PID: 6070)	Log file created: /var/log/Xorg.0.log
Source: /usr/sbin/rsyslogd (PID: 6157)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6157)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6158)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 6263)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/vqsjh4.elf (PID: 5428)

File: /tmp/vqsjh4.elf

Jump to behavior

Deletes log files

Source: /usr/bin/gpu-manager (PID: 5811)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5863)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5954)	Truncated file: /var/log/gpu-manager.log
Source: /usr/lib/xorg/Xorg (PID: 6070)	Truncated file: /var/log/Xorg.pid-6070.log
Source: /usr/bin/gpu-manager (PID: 6158)	Truncated file: /var/log/gpu-manager.log
Source: /usr/lib/xorg/Xorg (PID: 6263)	Truncated file: /var/log/Xorg.pid-6263.log

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/ps (PID: 5596)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 5974)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5738)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5836)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5881)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5980)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/lib/xorg/Xorg (PID: 6070)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6021)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6181)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6189)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/lib/xorg/Xorg (PID: 6263)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6302)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 6341)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/vqsjh4.elf (PID: 5426)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5439)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5719)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5738)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5739)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5809)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5811)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5858)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5859)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5863)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5886)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5891)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5951)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 5953)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 5954)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6007)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 6032)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6063)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 6068)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 6070)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6089)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6021)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6094)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6155)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6157)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6158)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6189)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6216)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 6228)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6256)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 6261)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 6263)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 6296)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 6281)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6282)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6302)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6311)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 6341)	Queries kernel information via 'uname':

Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.476] (--) vmware(0): mwidt: 1176
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.848] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.938] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.775] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:20 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.608] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.977] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.056] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 281.984] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.587] (==) vmware(0): Using HW cursor
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.009] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.417] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.643] (--) vmware(0): depth: 24
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.546] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.419] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): w.grn: 8
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.863] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.304] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.364] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.675] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.568] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:45 galassia /usr/lib/gdm3/gdm-x-session[6263]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.510] (--) vmware(0): w.red: 8
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.832] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.943] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.074] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.683] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.216] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.578] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.374] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.647] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.066] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.348] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.710] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.099] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.023] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.409] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.043] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.120] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.436] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.692] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.098] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.198] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.843] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.203] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.737] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.401] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.083] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.811] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.736] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.855] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.207] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.806] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.657] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.164] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.758] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.091] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 278.755] (II) LoadModule: "vmware"
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.900] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.110] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 278.790] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.845] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.891] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.528] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.924] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.854] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.930] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.854] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.745] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.019] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.863] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.666] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.770] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.830] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.572] (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.607] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.374] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.016] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.820] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.735] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.845] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.485] (--) vmware(0): mheig: 885
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.256] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.181] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.990] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.872] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.971] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.010] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.881] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.082] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.773] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.165] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.789] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.294] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 281.923] (EE) vmware(0): Failed to open drm.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.110] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.464] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.722] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.545] (--) vmware(0): vis: 4
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:55 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) LoadModule: "vmware"
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.517] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.241] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.649] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.035] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.550] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.086] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.086] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.024] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.684] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.017] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.486] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.502] (--) vmware(0): bpp: 32
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.613] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.108] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.996] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.412] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.155] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.438] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.392] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.303] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.663] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.810] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.647] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.875] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.121] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.405] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.856] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.101] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.564] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.283] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.468] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.578] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.980] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.393] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.007] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.132] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.285] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.225] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.308] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.798] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:46 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.793] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.231] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: vqsjh4.elf, 5426.1.00007ffe3cfdf000.00007ffe3d000000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.fDts8u\
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (==) vmware(0): Silken mouse enabled
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.477] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.699] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.424] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.355] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.172] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.802] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.365] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.242] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.475] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.149] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.575] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.367] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.357] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.330] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.638] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 279.366] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.344] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.123] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.493] (--) vmware(0): depth: 24
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.726] (==) vmware(0): Using HW cursor
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.487] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.241] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.707] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.668] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.889] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.469] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.855] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.938] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:07 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.937] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.922] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.717] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.612] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.229] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.750] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.901] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.092] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.729] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.051] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.055] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 279.144] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.896] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.709] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.222] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.597] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.306] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.697] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.326] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.672] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:45 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.597] (--) vmware(0): bpp: 32
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.447.dr	Binary or memory string: [ 281.940] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.656] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.828] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:46 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.764] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.781] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.758] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:07 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.190] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.631] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.035] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.294] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.756] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.804] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.669] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.492] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.850] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.928] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.322] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.419] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.285] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.176] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.622] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.106] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.454] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 281.963] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.497] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.012] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.500] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.449] (--) vmware(0): bpp: 32
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.910] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.065] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.784] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.816] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.058] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.876] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.737] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.537] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.891] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.639] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.585] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.791] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.237] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.054] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:55 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.505] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 290.540] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.471] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.659] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.727] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.281] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: vqsjh4.elf, 5426.1.00007ffe3cfdf000.00007ffe3d000000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.801] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:06 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.614] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.191] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.873] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.627] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.157] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.717] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.007] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.969] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.197] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:07 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.146] (==) vmware(0): DPI set to (96, 96)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.820] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.071] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.952] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:57 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.676] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (--) vmware(0): vis: 4
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.449] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.672] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (--) vmware(0): w.blu: 8
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.119] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.708] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.111] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 239.594] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.211] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.189] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.490] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.061] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.254] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 246.962] (II) vmware(0): Terminating Xv video-stream id:0
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.256] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.160] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 240.134] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.864] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.685] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.963] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.139] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 285.121] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.971] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.210] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.883] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.044] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.981] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.942] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.237] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.203] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.536] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.716] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.612] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 282.607] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:59 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.444] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:01 galassia /usr/lib/gdm3/gdm-x-session[6070]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.086] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.073] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.761] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:45:00 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.150] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.945] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.169.dr	Binary or memory string: Nov 21 18:44:58 galassia /usr/lib/gdm3/gdm-x-session[6070]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.466] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.753] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.826] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.584] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.678] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.254] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.084] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.312] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 283.457] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:49 galassia /usr/lib/gdm3/gdm-x-session[6263]: (WW) vmware(0): Disabling 3D support.
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.864] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 234.217] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:50 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 232.095] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.447.dr	Binary or memory string: [ 284.557] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:51 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 231.990] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.328.dr	Binary or memory string: Nov 21 18:45:52 galassia /usr/lib/gdm3/gdm-x-session[6263]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.299.dr	Binary or memory string: [ 233.784] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5849)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5994)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6207)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: vqsjh4.elf, type: SAMPLE
Source: Yara match	File source: 5426.1.00007f61fc400000.00007f61fc41f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vqsjh4.elf PID: 5426, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: vqsjh4.elf, type: SAMPLE
Source: Yara match	File source: 5426.1.00007f61fc400000.00007f61fc41f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vqsjh4.elf PID: 5426, type: MEMORYSTR

ID:	1560604
Product:	CloudBasic
Start time:	01:42:07
Start date:	22.11.2024
Sample:	vqsjh4.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	cbe293c20f35d924a4db7bbc4a2019bc
SHA1:	ae5972538150e47965fc690d03a8b4f6bfa2ba12
SHA256:	7ee2658dadda272b56464d8400700bed1338707ab1a6b65c83d0d6dbf6f619d3
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink	ASCII text	FF001A15CE15CF062A3704CEA2991B5F	B06F6855F376C3245B82212AC73ADED55DFE5DEF	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source	ASCII text	28FE6435F34B3367707BB1C5D5F6B430	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
/memfd:30-systemd-environment-d-generator (deleted)	ASCII text	5EF9649F7C218F464C253BDC1549C046	07C3B1103F09E5FB0B4701E75E326D55D4FC570B	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
/memfd:user-environment-generators (deleted)	ASCII text	769AC00395ABDA061DA4777C87620B21	AC12A8E0EB413395C64577FA7E514626B8F8F548	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
/proc/6039/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6042/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6044/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6046/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6048/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6050/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6053/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6232/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6235/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6237/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6239/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6241/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6243/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6246/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6296/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6323/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6326/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6328/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6330/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6332/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6334/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6337/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6502/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/run/gdm3.pid	ASCII text	A3D4B0E66DD7045135776D238E5104AC	DF4160F5199C125CDEF991D30B6C478659992C51	DDD9E37E81C1A9624376C33D18BA21EFDE880DF1BB0CCC9D17B007229F70AB82
/run/systemd/journal/streams/.#9:6292388GBwD	ASCII text	2227A36C9F7CBA144F85D33805FAA26B	236686D803DA879B31BB3E66FA7E198725CB13E2	8195A8612EDEA9B235CD9EB446CE2BDC64842591C798000AAF4E7EB1E8F299E1
/run/systemd/journal/streams/.#9:62925wCQ3jC	ASCII text	BBBD974DBB364AE63877F339B1FD0CC7	476B2906091F78474E1BC8F7FB1E96301693D739	D1D5E030978272445CC4CF59E610FC05FD0C39145B3703E852454E6130F97842
/run/systemd/journal/streams/.#9:63083NzRQXC	ASCII text	9F8A0DBE6D09BDC118BF639A27AB22C6	E64EA0D5719446DD8463AB8BA680455D2440F74B	6D0789CC52FC1DF55E4E0A64F79DBACEA4E1797614EF6C6C8B4DA5062847BEF1
/run/systemd/journal/streams/.#9:63098z9NdlE	ASCII text	AD5BC867205B117F80D462CCBDB60841	77C173D9170FC0F356AD97DE490C411BEC60F98B	E39C3BC52BC90C0333F2CBF0CC4A90AB5CCE5C4F9BA050C4BA6D788B99B37209
/run/systemd/journal/streams/.#9:63273f4ztlC	ASCII text	BF4AD8429AA02309F0B39192851576D2	6FA6AF849EB01B6F0776DB17A5EC4CD599E0ED69	A894B62A19018DBD36D6D197FA8B01DAE5B10E309CAAD679DB9DF635080A20FF
/run/systemd/journal/streams/.#9:633713aVsyC	ASCII text	0DB7C24659889C0399A356C4A8DC8378	FF80BD4026D29B9DB804D860C251F56EA60139EE	86CAF26FDFAB71C1939CAD1542C24F5779F318678EDA4A7F84783F8F590CB92E
/run/systemd/journal/streams/.#9:63406GyvirF	ASCII text	B15B46A6164DB2F2768085491B90C7FD	BDBBBE4C59A2375C3E26C45EC25D588FB7ECAE3C	0D12D577E83D5E49AD55786B1CC29C8C71E9F0DA60EC2E5A1AEC08331FF1FD11
/run/systemd/journal/streams/.#9:64678MvfFpD	ASCII text	0921CEAA504F43AB4F078E0EC8485C26	E4BEE74264C6F0F6968E69EEFE6CBBEB65012F0E	091392B038AE5A56C89A1C9D1294972A2FF4E3420C7B2DF77CEF56B35D7059E0
/run/systemd/journal/streams/.#9:65729BdS3jG	ASCII text	60680280AA520B150EDEA1266CB8C721	1B5D24AA3312346A9C3659A36AE8CF34D7D3E32C	6DDA2F0EBF40E7A8C8B1E21B624642DD47236B6E7A9F261C89A326DB727E3B8E
/run/systemd/journal/streams/.#9:6582174yFfE	ASCII text	1A34017D831EFFE400B811577E9ECA72	4DCAEC5D401EE9511BDEB90C17E2A089358CD70C	66FA921CAADAE5C9C6D01AAC284FE89F7438600A1D4A8F0D2852E7309B4046B4
/run/systemd/journal/streams/.#9:65909ooLrAF	ASCII text	4C40017DD149066EEECF17059D5715A4	7996EC99495E3B7071293AC5F84417F78BE2E386	716EDC1C849CCCC203E3E92DC8CACF84EAAB0EA34B793A7A92A941E1E6D3D20D
/run/systemd/journal/streams/.#9:66005tEG3YB	ASCII text	3FED2A43E841D52524F7332C35186724	F105F865C632BA1E9017227FEA4708BB1B28F242	56297F0B60E6E8156CCD5B136EAAD3DEBCAE5CDE1E8FF430044288C99640FC1A
/run/systemd/journal/streams/.#9:66124UkKYNF	ASCII text	15DC4CAF0FA29A6297628F059394235D	5C4BD37FCF01A306249F24EA688E041E183853E6	38A9A4EF033CBF6981921D5D3082FCE4A0409CB62C64C0B016EAECE437467A0B
/run/systemd/journal/streams/.#9:662974gcYCD	ASCII text	073EA1A4DB2D6549A61D6C12D78F89E6	330B2397E70787663FB4DB56909C0A7EACC40E0E	8FA565CD92F8C5220CBE7ABBF37E76609A233E982A3D98C76E68B13B023D8CA5
/run/systemd/journal/streams/.#9:66382pKA9mF	ASCII text	2388832429D3D3D04C9729647FFCA86F	FEB9E8ABE1445332E2DCC143C3D2DAD755E52D8B	82133FB45673A5058A1E01D44C00DE9E0C54BA1D8922F0FE5AD7B5820B673FF9
/run/systemd/journal/streams/.#9:67066WCv40C	ASCII text	E48FA6192037B4EEEA41CFC58358198A	4DE6778764FF41927CBF5CC51129CA4959BC12C6	700E3C64A3483AC4A5D677BF3FFE032F935F9C1987CF9634AF71AE9EF86D3D19
/run/systemd/journal/streams/.#9:67067mrUnJF	ASCII text	5EB8D8ADD210D7F1A2A34751ECCBB8AA	A09802EA28BE90686D4B1FD83CF91CF11D5FE439	DF78F8710D5E45AABDA109F7AC339CB5F9B5AEAB17662F162E698B342087BD6E
/run/systemd/journal/streams/.#9:67068VxdrmC	ASCII text	9CA8EF964FC7087DCF6805E14F7E78D1	E8C9906CE881216748F7155262875D75207954F3	2CB4A84F1B6FA2254EC3D512550A223B4B00AD3FFFC4D0E1C261C0B3C1BFA11E
/run/systemd/journal/streams/.#9:67083f6vI9C	ASCII text	4D8ACC1252648FF5405291ADCDBB3156	67F0E388BD972A2BB671F59458C2009CA82ECE0B	FCAC057FE5786A3C08C65A13041147148CBEF96F37A18F778B2FA103FEEA81F6
/run/systemd/journal/streams/.#9:67084FAbgGG	ASCII text	AE25A9E3F67B6375C1EEE4BE8B34525D	6B7A931013331899636AFF6850EA93DFB0D0FE18	8E0FC9832D1889D4BAF87DE14167F8E4E2515C774C3F4722274DEA82E9C46CE9
/run/systemd/journal/streams/.#9:670857Uuj8E	ASCII text	35CEA70A19E001516B2C64B3DE218ECD	C6FC4EF494269EC24783C3942FA00775EC7186BF	EED9FF2F976CB8B7ABA2AE2F344C55A17F7599914C1F7CE3A7B0774F0FDF7D1E
/run/systemd/journal/streams/.#9:67163UCC0JC	ASCII text	964D44B5C2B14F1EC9BFE45E31BF5B09	6E73C73A87F54B4BC472AE4EACCFA1448FCFD24D	778DD76154037854DF80707673F24D4948C737AA92FFED008D5B04891241024E
/run/systemd/journal/streams/.#9:67165fvqDFE	ASCII text	E8B536D51395C555DAAC259B758B3F95	413D6B8BF43988C7141F258DCB5988FFA3B576F0	DA162B3EDFD3215F476573B2F269CE436A39789FCF0A54D63D4B083A1F2879F2
/run/systemd/journal/streams/.#9:67255HqwMDF	ASCII text	063DBF006C1294CDE9D333500BD9B171	B653F06D834BFB254EF263BE85228F7A709013D8	9FF07CA535F7BCFDC24010FFEA0ECD6052029FA077E72A4DEBAC7527F8357737
/run/systemd/journal/streams/.#9:67388MRnhhD	ASCII text	C6F08A1DC71988B87BFDF0F6DFDCCE3E	40D74EB55E86D6EAC22E8A1E5FAA8B5ED1177E12	B0545AD0178DBEA6DC773E797986415E3160723BCD841DC99D17CD51E0E4EC85
/run/systemd/journal/streams/.#9:67390XdSkJG	ASCII text	4BCC6CAA765BB549EF17BEFEAB8D37F2	034A375E918A193C59A37E2CFA2457ED7E0EA104	FE9EA8D5CEDF4474C3B3743481AF41BD62FCA7BA5D2ADDD5A5FE1F00FA42B6C3
/run/systemd/journal/streams/.#9:67499wYL8SD	ASCII text	720A7DE62376B66B894520484A6471A9	FF925F449B6107BF7D4CC9E14C7F85CB1EEC0260	DD718DF32045C4E4BDBCB8AC9660529AD131CF3ED3A462D0FAA74D23471B4894
/run/systemd/journal/streams/.#9:67685ebVStE	ASCII text	56298E8E1204A081455F478249B725F5	24F8D02B27777FDE527C97389BFFA3BA9F96E246	64BD209064AAB0F40B556C31502A39DFB6550C1D1581B2EE4B1B6AB21E2B7ADB
/run/systemd/journal/streams/.#9:67742XBPJRC	ASCII text	7A829DA5131DC0D8AE05EA71ED1CA7CE	31871CC893C5B6339EF233F5EC1383272F7DCE15	32DF0ED19906A23268BBD0F3853E15755290B46DB626D921BC29881CC365C02E
/run/systemd/journal/streams/.#9:67766wJIxPE	ASCII text	D09B4E92D73E48DCC84254E74774E9C1	ABF2D184FE02EC59228B22D4C46A3FC22164DB46	C881909907BA747D47EEDB6CE3836FEA0FC89DBF1BAE1B8BA79DCF196C19CF35
/run/systemd/journal/streams/.#9:67772WfmdCE	ASCII text	03EC815A08340BA782DD413164FC614B	3E92967C8161172858F4FB01428A8C87851BB4EE	EA79691EBD0662C4C374377483F906708FD21B8FA043B3D7C3F9A303900528FD
/run/systemd/journal/streams/.#9:677744LDODG	ASCII text	71333BE871ED32BFD2765A9E0057A938	AC9D827FFC1DA2566258C1ABDE35417EBE39DAFC	ACCF98D489CA4A50EA05DE15138B1ED0B13D4334B16B05BC76D6CB20E2CECEB9
/run/systemd/journal/streams/.#9:677753oXkQC	ASCII text	3411482FF368D3673D28D3592CB4333D	E27EC8CBFD512440D600E0D7F27FD74C42EC7930	9A48357FCD09512C1FC866ECCAF51E08600AA7548958FB46F7DB6F23A8405E45
/run/systemd/journal/streams/.#9:678198AFzEE	ASCII text	282D1CAB9CA5B427EEFA9316B43F644A	A2081E0BA868AB713BBD37F9467B4855B1620B2B	043B6EBCE9B308D64CEDD72A53AD6649DCF18B23A8FEA689DC70C24C77AD7955
/run/systemd/journal/streams/.#9:67827TfCy0C	ASCII text	88DFA670EA107385FF80BF7C171D4274	A7075EBE5A91ED95C2E0F63C09DD206F36AB0CEF	18ABA3B126B933534F8E2FA8DD288C6517E52848A29EAA499B4AEFBB21C92A88
/run/systemd/journal/streams/.#9:68896NA9nrD	ASCII text	2FCAAFAEF01E3D90D82A239A50A0F8EE	65E6DE10550870B2893382AD8F2A2E646D42CFBB	B9F85B6498A43547D9AD9D78907FE509646E4783B7462FB2D56137576DCB53CE
/run/systemd/journal/streams/.#9:68992rvjzKE	ASCII text	6D4C7C40134E9FA5F07427F8C1DCC48E	F7F81BE060A5AAAA2287AAB17BE9605764C15A1E	A592CD732052AC1AD035FFE59CD8A99933539C539A78D2B99C0DF231EEF99167
/run/systemd/journal/streams/.#9:68994EZyMyE	ASCII text	E096DF44DC2952BB250676AD28008502	7942F45BC2CE8F7B150489AC4D6835A7EA60275D	3F2F3A275DDA038C62EF5EBE72ECDD2A71941DB169E0EA51BBF146DB4DD104BF
/run/systemd/journal/streams/.#9:690391rf9zF	ASCII text	CEA020A729C0CAB0421B5B6439F5FE92	6BCAB486AA521225938859563B9567FC034D7657	65C57AE141286E6F2F72E89623812F6FEC245D8B5EED3389774A1484AE5C8066
/run/systemd/journal/streams/.#9:690414LrkhF	ASCII text	F3117AAE29CBEECEFC99C3B22A046520	8B938D43CE86DF8B1D73AE51C33B366E2078A0A6	E140433BE1491C26531BDDD9206BF19D787BADAAC246F4EA37AC650A86455572
/run/systemd/journal/streams/.#9:69120bKq4zD	ASCII text	F0B09F7C2AE416F5F8784D721FF5DF1E	4DEE4745C9A54485D7E5A5725A2045C1C81B520E	4A09B91F59A1F394378B93B9DDF841C7EC05BEF5F341CE820DE4C071E865ED08
/run/systemd/journal/streams/.#9:691224aZcpF	ASCII text	459E8BD436616D7A0012648CC4A249C6	3FEEF2705B3B7A50DC287CC26AD2F2B9D78E9644	564D76C990B5376F5F489B5F09218E642D30BB29ECE7F42FD301E85311ADB461
/run/systemd/journal/streams/.#9:69172aqWHAG	ASCII text	4862ECC05F364ABAF30FFD91A6210C9A	1423A983D71FA12806A3B3C2C02DFAF2633A6193	FD8E92A588E3E3B27A6B6681C34FE6A7F2660F07915ED5940E6D8670FAFA6835
/run/systemd/journal/streams/.#9:70077KhCX2B	ASCII text	92E2DD3601074F19702AB3FF66B11849	31397FBCBE0D680B6A538CBACDB2D001C60F2859	AF33F421E1CF5C268688CE041A10B6A0BDEC2B9A90284AE8952D974C52B8B994
/run/systemd/journal/streams/.#9:700787A6YeE	ASCII text	02C98BDEFBDFBAC8B422A10733FC6E05	25B3C189D31CDE73C93A39CBD71C867711500856	E5587BBC5BD67FDC9C07BB294ED07ECE2220ED1FA07AAE1A7745C84B8541C92B
/run/systemd/journal/streams/.#9:70081WXBUPB	ASCII text	071F34818FEF5AF711B5636A0E3199CB	04AC6F0C72E2BEB3F5BDC4BBCBA901FC6C71B2A1	D53C3D6EEEF936DDDB3455E9EA6238E96353F03ECF4BD85BA7C853E803310F5C
/run/systemd/journal/streams/.#9:70082xDlWwD	ASCII text	5A4ABB5D27B789B596BDED727178C1CC	7FDD0D943651CF7DDC505EE460BAB385EFABB86E	A7DB83A8D2360B2B6D2BFFFF56C902B06FFA2546E6114594852A27820D4857E0
/run/systemd/journal/streams/.#9:70093frtu4z	ASCII text	1C754E224E74953B0CCB2683ED267717	C4235235772B5E9041A51C683E8FD65E031263F6	0AB9761EE0E20AB25ED6739B4754FA192FFB2AE0F1CA81E828BE4B7C4C5C9882
/run/systemd/journal/streams/.#9:701004sozdB	ASCII text	3B72855F45FA0AC5D5F064907EF9A862	241E5253629AD32D07081A3946F28C882CFD2163	90072FD28A7E10F771EBF507722D5B20C43284A3D2E677672544DBE5AA1E5207
/run/systemd/journal/streams/.#9:70101D85c1z	ASCII text	236685C0FB4233DC945DB25E919EFBA0	72913944C9223B17F55840048321ABA6A048D63A	2F616762F08FFF4EF2380621424EF4E0A0624812A22EA76D77FCA969145389E4
/run/systemd/journal/streams/.#9:701021h9J8D	ASCII text	B73FAC13312A63861600D24287ED0B6D	58517A61BC56ECF8BD08AD283770C5D36A528B29	F56DD7E628401FF76FB08A6707224319030B9E295CAC82FE4BF4824FBEC79C34
/run/systemd/journal/streams/.#9:70308YivxQC	ASCII text	BC730D67F48A407E97CB6A3E124C4BD7	53B0473175D49CC4F1100A06F552B5EF5CE28154	BA680A9825B1E3110238D1477F3450361AE54E741D770F08074970BE0B838876
/run/systemd/journal/streams/.#9:70433CvqNNC	ASCII text	80FD129795DB60978734C7FE278E5D5F	35C6BB5DC8F951D3605948F3EEE7291C08F6225E	252A28FD6AE6D81A2576870E3F3F4FE34565483F38B27D10394F62A21AA3C21A
/run/systemd/journal/streams/.#9:70521OHR7cD	ASCII text	CA73DC56B2DF89DEDC2B0F31102C5E14	D87E88D54EFAA4C19D251C4C43CB9A677551BC97	BA0C4461CED3DB6BAD72EB3444453FEA18C5DBB219A332D8FE0BFD525E915DBF
/run/systemd/journal/streams/.#9:70697218Y3C	ASCII text	EF4AD8A681E736002834D8202385CF16	F4058A9EC004602F78772E08598FA1B018E3BCE4	86DAE1290F418FD7E68DC23AD98BE72F6DCADAF765BB9BF063060D5E690536E6
/run/systemd/journal/streams/.#9:70709nS1JMz	ASCII text	6DA1393E380E69D4E0B8B6F6B2663848	CB49F459CB8D17A09CF054816B3FCD4CF508F3CF	C882AF6B392BCC75AB261F189AF24E1A187BC1E9B632B887FCF3F050A0A2634E
/run/systemd/journal/streams/.#9:707158EEO6B	ASCII text	85B8E803232AD346ADE2003C290F914D	D677658DE36AC2B2E791E87A95F2F45EE47846ED	1C45CFF579AEBEBD29B455907946734323F43A0FB3237244B7FC32025EA7B904
/run/systemd/journal/streams/.#9:709265YWBcE	ASCII text	B217412513DD8DF35FF93AF82DF04092	B51F6065EF1FB2E4FA3A3CF26EC07790E479BF52	57DEC50D09C78F312FD16E574267F153AA8B235E61BFB95B753B6CA4FF6ED1AB
/run/systemd/journal/streams/.#9:70927gTEczD	ASCII text	8E989970DD7C4FA6334934D74DCDC5C1	9B8C422B237ED4A5D6457C2DB28B18E192CB192E	1DB32ECEAD75CC7B56ED21BE2A873CAE8306748EB80D092589E8E5E0BD2EB2AC
/run/systemd/journal/streams/.#9:709567wXMOD	ASCII text	2B830E91613900CC206ACFEDBAF0AC20	7DC039E5EE47F2E56ADD2613D45E905E08E42513	7A65CCE516459D87C13A54AD900614D2DE0C2B6F6FF92F8F7DFBB97F0215986D
/run/systemd/journal/streams/.#9:70957GDjXKz	ASCII text	7FB2CDAB2C60B604608B61608ABB94F9	535507150B0D30CCE2D710A966B1C2E43976F2C2	B1589E72A9FB6FCDBB1D7E0B6FD276FB256037B19C5D31F0764A768492AB6C5D
/run/systemd/journal/streams/.#9:70997whIuQz	ASCII text	8055140BE916772452119EB54567BC33	878D31C3B573214C2C03CD3BE24241098B0A1B5B	D6A2737187E5D2509BF19CF67165A9E98F4524BEE75BB5D061F8432C39839ADA
/run/systemd/journal/streams/.#9:71046U4QmYD	ASCII text	6DE5156C9E92F7E9FFCEEEC315CE787E	BC4FE1A0951FE8677223CDADDA2BC0F67FED6DF3	DB96483B5E039C9973202F455E70BD59F09C773806700CB1F4B180F71ACC66ED
/run/systemd/journal/streams/.#9:71089rlFdLC	ASCII text	F785B6E96C7D8CAEEFCA4676F3412EC3	163877B9AFC534024F66222CB046DAA5A7279D9E	0FD2E0C5643C08A3271C91BCEDABB58708FE6D43617C1F368A87B662FCAEBF94
/run/systemd/journal/streams/.#9:71090mvzfGC	ASCII text	E81503E6F5B0C0725B5B81A9C696500E	CB9AD09896B0A9483001AF8BE389F6CA934FE8AF	2AAC08944BC508FF2EF23EDA837156D0ED9D22221D5F48958B5168A570188434
/run/systemd/journal/streams/.#9:71123dNbXTB	ASCII text	F832A4464089FDEDA96A3A94191AC944	5A9F93863710266793052F4D126DF884C934E132	316EECCBC01E4C83F1198F690932694325AC4801C1C066101CCE2DB815573FCC
/run/systemd/journal/streams/.#9:71124TfX9AD	ASCII text	785283D9658D217AB50FAAEA218255FC	C7432946B7E8A29A83DA81436B52A828F9A6508A	D5AD734EE2F7FEBFC31728DC867E201D882249ED2465399B4B404934575DADE9
/run/systemd/journal/streams/.#9:71192L7qVnB	ASCII text	468654518B17F158E9AE166540E73D29	8E0E3B4A6755B07A4C7B6ED12E72B4DE41E88607	19327DEF73BFD92DFC90F814F377DAAAC86D21B0FDF1B0D6C3CE353E6CB49F35
/run/systemd/journal/streams/.#9:71193nQBGlB	ASCII text	9E96A0BFE81B5DD4ACECC34AB37CEB54	7FE6DB9AEBA275B12E91C981B6C4E7D2D59FA701	69A1A4E0B593D60952771EA2B752D71871F41E0716BCEA4B8922453D9013D50C
/run/systemd/journal/streams/.#9:71360V5vz0A	ASCII text	3EEB1AEA3E3042415798E6F1AF64B0F6	B89EC20196850930EB5BC1DB34A6BFFA623DD3D8	09EE18226BBFC7AA09B531979FC1231E5CEBB28EAEC1BC833E7FEC8FBD5CFD95
/run/systemd/journal/streams/.#9:71600cPVQbC	ASCII text	1F1322513BE7FD0CE3362AC25C6F0F4D	7FCD79F814CB027E63650061C39A8E88CDA56EB3	E812F0D8ADC77D4902CEF476E27A4F4A7168C53FCFF0098273601E3D04D47872
/run/systemd/journal/streams/.#9:71601csgg7D	ASCII text	A6EB12BA20A92014F35B4C32FBE20229	0DA6D447B51C773599B71994EA89E7DD100BB732	F69428B471130B52D4601935783BCAAF3D1F7C2E002829F05D9301D1425072F9
/run/systemd/journal/streams/.#9:720680dMBTC	ASCII text	B7998CAE682FDFF7E2BFF459B63CD312	1FDFA829DC1FBD0488613D76106BBA4D5701D320	DCF4B9C0EA88C80D24F40F638F4E2F501CE339BEA3E0C2B4AE9B10C94914F54A
/run/systemd/seats/.#seat001gstd	ASCII text	0EDD8049A9E5176912C3C2CBE234DFDB	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
/run/systemd/seats/.#seat00JqDaT	ASCII text	0EDD8049A9E5176912C3C2CBE234DFDB	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
/run/systemd/seats/.#seat00VLW6c	ASCII text	0EDD8049A9E5176912C3C2CBE234DFDB	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
/run/systemd/seats/.#seat01yPdhQ	ASCII text	66D114877B3B4DB3BDD8A3AD4F5E7421	62E0CB0F51E0E3F97BE251CB917968DFF69ED344	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
/run/systemd/seats/.#seat08ICyhc	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0C6DGSs	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0OiT4OR	ASCII text	638FD4D562360E2AE0FE6842F6853400	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
/run/systemd/seats/.#seat0VUL7Wd	ASCII text	66D114877B3B4DB3BDD8A3AD4F5E7421	62E0CB0F51E0E3F97BE251CB917968DFF69ED344	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
/run/systemd/seats/.#seat0Vo4IeQ	ASCII text	66D114877B3B4DB3BDD8A3AD4F5E7421	62E0CB0F51E0E3F97BE251CB917968DFF69ED344	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
/run/systemd/seats/.#seat0dNVZUd	ASCII text	66D114877B3B4DB3BDD8A3AD4F5E7421	62E0CB0F51E0E3F97BE251CB917968DFF69ED344	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
/run/systemd/seats/.#seat0fTNP1f	ASCII text	638FD4D562360E2AE0FE6842F6853400	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
/run/systemd/seats/.#seat0gAYdcR	ASCII text	0EDD8049A9E5176912C3C2CBE234DFDB	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
/run/systemd/seats/.#seat0qo3flR	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0sUhoHf	ASCII text	638FD4D562360E2AE0FE6842F6853400	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
/run/systemd/seats/.#seat0tDoKYR	ASCII text	638FD4D562360E2AE0FE6842F6853400	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
/run/systemd/sessions/.#c18SIFsQ	ASCII text	A5F76CFF98D40975BA83F39036FE7308	0930B64CE0184D5F41A195F3E31AA59ED6F61137	0FDC5FE0DAF8C12092FC1717A67A8B9A823BCF1B26E854E2F5DAA4D61992E436
/run/systemd/sessions/.#c1A4HcZc	ASCII text	4A99E512068B775CAB92811478324FE1	4A43C28C76BB86CC8A57FA96369CFC9F1445BD43	61E71909903FC2694137962EFB27ACBF329076B0299341F3C6E59AD9ADB6CC2B
/run/systemd/sessions/.#c1DjPMHd	ASCII text	9C2770B52EEA8C61C5F10A7108286968	223B59FC20E044DB3D8FDDC4CC2FB2C959DE67FA	C08CC5E1C51430B349345712CD97F672CE83504257B60C1F11FCD43C08652F54
/run/systemd/sessions/.#c1E2msjg	ASCII text	44A8758B7F239CA1534B626FEA28A3AD	1059ABFEBE705C344780DBC3433D87F02A885C27	7635183B4C827A3854E6FAAAD6F96B0CB1205918A2F74AAAB61789F44F5786B9
/run/systemd/sessions/.#c1JO8TTe	ASCII text	9C2770B52EEA8C61C5F10A7108286968	223B59FC20E044DB3D8FDDC4CC2FB2C959DE67FA	C08CC5E1C51430B349345712CD97F672CE83504257B60C1F11FCD43C08652F54
/run/systemd/sessions/.#c1OBsUtS	ASCII text	6B0C9D48654727A5B944C47DDF03DD0F	0D0E8B697F5C24F45B0CFED5C6C31D60A94E87D3	460476627F8BB3468542E6AAD1B7BB5150B73DFA2FBA2CD214250D85D262AD78
/run/systemd/sessions/.#c1Pff3ES	ASCII text	C54602A7880D14AD0A846522D2388B5C	9809AD942C12083E973AC28DE6BA2D44F5DC8C4B	408FFE6ECA83A1DCF29FE854B51E72DB87A42AE76AB0AD9D39881871988CC701
/run/systemd/sessions/.#c1PjuARe	ASCII text	9C2770B52EEA8C61C5F10A7108286968	223B59FC20E044DB3D8FDDC4CC2FB2C959DE67FA	C08CC5E1C51430B349345712CD97F672CE83504257B60C1F11FCD43C08652F54
/run/systemd/sessions/.#c1Wpk6zT	ASCII text	C54602A7880D14AD0A846522D2388B5C	9809AD942C12083E973AC28DE6BA2D44F5DC8C4B	408FFE6ECA83A1DCF29FE854B51E72DB87A42AE76AB0AD9D39881871988CC701
/run/systemd/sessions/.#c1isnEQc	ASCII text	CF29645C835F1788BDB978819EE4AF30	CD034099298F4985F5ABA196FCBC5B7D5372F347	95105FC7FCCDDD37D030C287BE254CDA355FAF31D698418E287F2613B20AEEEE
/run/systemd/sessions/.#c1m5rrWT	ASCII text	C54602A7880D14AD0A846522D2388B5C	9809AD942C12083E973AC28DE6BA2D44F5DC8C4B	408FFE6ECA83A1DCF29FE854B51E72DB87A42AE76AB0AD9D39881871988CC701
/run/systemd/sessions/.#c1zafapS	ASCII text	43CD7F541A377C9F8D06E3E2D6C50CE3	37194C001D021AEB50A4D1EF66FDF49182AE575A	A57D0683C26DF335BCBB9739EA318D27721205A815A867FFDFF8A40B246A29AA
/run/systemd/sessions/.#c21ja5uU	ASCII text	D0F40858CA5EFC4D87DD076E49E2951D	B725867D73CFA781552576A16903917297D3831F	1849874D78D1ADCF8559C63272C1A9EC7CB10E7CD9C08EEFB04C2C16D977BADE
/run/systemd/sessions/.#c257I38b	ASCII text	004E5C4A360D933A628AFB2C91B8286A	ED749653B7D90B6E93C85B70EA3E34800CADCB6F	F6F88E4C739B0995164F1996114E22E6D378B32BECAD3DC4E490DB7052EC1B74
/run/systemd/sessions/.#c28ShBAS	ASCII text	06FFE19BE8476253B1BC8C98DBD45F23	34BA3BDA77C96357A80FDDC7A01133FA5965BA4A	659E24DFF3832C723681AF278326FAF87F8374E57AA3F5CC9F36447C852585F9
/run/systemd/sessions/.#c2DoAHfS	ASCII text	D81794AE5143639F742E396CE3FF8ECD	A0F684A9588E5B6C4A276943B0764400518183C9	DF6DFECB90DD79BE4A6938BB509C82F28DDB8EC6F386229D03B8F6D008A7312E
/run/systemd/sessions/.#c2WsBGAR	ASCII text	2F3E18121E1E0B4245C9BFE5335B0259	EA7FD4A4D752F616B92F07B1A42EAB2B01BEA321	C64AF42CF3BB50AC9972FD11DCA0E5C9E07B7CA75FA5A6AA5361A537A086E0A3
/run/systemd/sessions/.#c2YSjhec	ASCII text	EB06EC646B825D1093D07C46CBFA542D	EF92507914764D69221E6F8A35C510DB7D03D241	0576D66124AD7DFFF60BB9C2144D8FCB6592B2347E2F22D515B3BE9DF94FB022
/run/systemd/sessions/.#c2bZnxkR	ASCII text	F6D5BE59C66820255860948340D1A296	B3F48CEDC7A42937D4E6C2F4105B56641CC089BB	900B683EE35BEFEB268B84C8D270D0DFF387A6FE3488204FA46CFF327C824E4E
/run/systemd/sessions/.#c2dBL4Kf	ASCII text	318BD22F76AD754213D15084F702BFF8	1696872597E0ABD1054218D217AFB19484D84C87	578781D30E3378C9F45DF8D5790DA8885C2CEADEAE6774DFA7031D367D620822
/run/systemd/sessions/.#c2dUm8Yf	ASCII text	004E5C4A360D933A628AFB2C91B8286A	ED749653B7D90B6E93C85B70EA3E34800CADCB6F	F6F88E4C739B0995164F1996114E22E6D378B32BECAD3DC4E490DB7052EC1B74
/run/systemd/sessions/.#c2f8pfOd	ASCII text	3D18AA9CF98BB267E32CC1C8F304BEF6	986CA76C0AD15336BA3F8D13438BABB2F4FBCB12	A1B131EB97CA98FFB18C08BA79B28242C5D4734B8C3FC3F1AE72508950FBDC0F
/run/systemd/sessions/.#c2ntO00e	ASCII text	D4952E24A40736BBEC28A293F01ADB26	5488B430DCD2D74465DA07C01BEBCE2933790CF5	F961B9F0016956254547EC412DC9C940E12A211C11C09C8A7593734C693BC6D8
/run/systemd/sessions/.#c2owUsEU	ASCII text	AE42AF5B61DF1DC5FFD7D6AE92B60B4C	F3B97E0F60718DC503278E86A8771968D9187C5F	A5D605EADABDB1E4948F144267DB035F2673413CBA5E4BAFA33A6CAF6F31D90C
/run/systemd/sessions/.#c2sWN4ud	ASCII text	09A3472650AFBD25169309FB4B3D4606	60B6E832D8D851E199D1CD41A3FBB7411A0BFB15	CF4F6076B020AB8070DDC80F9C468C02C55985A6B44C561BDFFE6CD317CCD0F2
/run/systemd/sessions/.#c2toy01R	ASCII text	A62FA98C92083F414B498DED7FD16C10	F5D170D622ABE2A25FCD89E45BC1CF41D0635FE0	51BBCFF929A7B135D24A7A5062F9D7A849B0039E8F3264A4604F42C79B9795AB
/run/systemd/sessions/.#c2tyJuoT	ASCII text	D0F40858CA5EFC4D87DD076E49E2951D	B725867D73CFA781552576A16903917297D3831F	1849874D78D1ADCF8559C63272C1A9EC7CB10E7CD9C08EEFB04C2C16D977BADE
/run/systemd/sessions/.#c2y7pySd	ASCII text	8D008BC7534A13D5D673B3CDD260FFE4	974EB5F01E7856DEBFB3237FB89E4EABCD954E9D	BEC3A7EC8A373A2A33161ECE29BDBAB752A83A0A1A191393FC0D7E584D7A5F7F
/run/systemd/users/.#1271z7ZcU	ASCII text	4EED477F94ADBBB901AFE1CF7F342A3D	AB9D53D8E4A3F4CF10DCFD421DC604C17CFA0C0B	41976CD7BF7A8C930FA4B2FF46E7987085D8DDC79B63B46310A3B3C546A58080
/run/systemd/users/.#1275vbE7R	ASCII text	E52EA00405DAF540DC632BA6BFF332F0	62F5CCC1F34524B7B90C0F8661FC3A01C9480631	7F30896929A37A8C5F755AC66D9C3D33A11AF1E3877B5054D80B1816667753F1
/run/systemd/users/.#127BCHpzf	ASCII text	CD5CD4D47DA04C22AF7BA1A1C2087B52	0CDB768D11DD3A2AD66ABAB1A8081ED9312A8302	B7E017DCDA630FF11E605BAB10E9D3F9952CCED1B5D6B3869FF4E3565DC4EDAD
/run/systemd/users/.#127C6CMag	ASCII text	065A3AD1A34A9903F536410ECA748105	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
/run/systemd/users/.#127Ciz0UQ	ASCII text	76D744C7CA763BEA2037C085C7E0B6C4	62C89833B7D49D69C6830FCFED937626DF9CB49D	E4FD4A3BBC3DCD2053990F7903C455BC0AD120D336D0DD2CA12E381588D51EB8
/run/systemd/users/.#127FW9IAc	ASCII text	0CF938DA57D0CB5EC8A8450B46FF102E	C72499914A5078DB4A2E697F0343DB8D31BC663F	A24C74F328EEBBF07A745AF3915127C535A5D0A4E6D4EABC86D9F202D59FD07C
/run/systemd/users/.#127S4z9kS	ASCII text	998D65775B974837A1812D0581E86A5B	7AEBC38A97577C0E50D0AC486A3FA0BFC370757D	FF4997FA4C38AFAB546A9A9FE761EC158413B998B0B2035BF0ED8392ED5A220A
/run/systemd/users/.#127SPslXb	ASCII text	2BDF323BD3C6E12B9AE69ED59DBF2F36	92649A0932D7AEBF75CB0F28D9CA430813DA51E4	45FA7966000AF4B4DC5704BA1C4FAA99F39F5386CDA49A00C1FA894C2DA424C7
/run/systemd/users/.#127VQf0rQ	ASCII text	2B84DAA9AE6FFC92F7C725BA2E612B9F	D86FA3D504CAF38F97F2BC2D35463A3791510E8C	F8863855242A7B98761DE63B8283734A9E33ECC5894EBD7B73C22FA28A4BCD62
/run/systemd/users/.#127ZbY85Q	ASCII text	03D92DE1D05793E14E554D57B1967A14	95C6012BBD3752EC3CF5F886E5471525DF329186	662E0F43B3369172CA09E1AA374FEB21CCB1F9F999E90C86A5B722311B41836A
/run/systemd/users/.#127a0De9f	ASCII text	DB14D644A2CB18266A310156AAB09B07	E43D5005FF1C33566B2F236791AF2241EC812CC7	FDAB5CFF332096C7BF0EDCFE9FD80EFB300447813AD856C4BEEE68EA3BAD3426
/run/systemd/users/.#127grA2PT	ASCII text	E2EEF50560CF2853D9CFDE18651CA5F0	0861B7565C86533D0D5039A33F8FA0A06CAF1672	D9AC66B3D860C250B42B43C2695222174D5B0D2C0E9B8FDF3B7ECFC8AD5D841D
/run/systemd/users/.#127joqvGU	ASCII text	76D744C7CA763BEA2037C085C7E0B6C4	62C89833B7D49D69C6830FCFED937626DF9CB49D	E4FD4A3BBC3DCD2053990F7903C455BC0AD120D336D0DD2CA12E381588D51EB8
/run/systemd/users/.#127kn7ErR	ASCII text	065A3AD1A34A9903F536410ECA748105	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
/run/systemd/users/.#127lFXjqT	ASCII text	60C8D29A068AFA36F45DE48D8B05031F	D5A22433ED8CFD3FF89F8811C33A3F3FA40994E3	F6796545AEE32067DF6FBE7650F9A3B3E1693235A99652DC026718395129D8CD
/run/systemd/users/.#127m2dojg	ASCII text	5777654EFEFCA5BF2B29AFE42D76341C	FB26449265C80B66EF41A3B0B6344A05FC851E09	41F0B4960D9BB9FE3722766C3519C819C8C236811E6D3F0B7F486FEBD32B044A
/run/systemd/users/.#127m32PNf	ASCII text	A46046DDAAA9D657F90E37E331C8FE96	73D60414F3AB3396F70DD56AC04D05E49BEA8CFB	CECDD05018B87913DFAE968602BCF44E73CD7EAA0E2897540E056B4BAE43F291
/run/systemd/users/.#127mxegtQ	ASCII text	13BC268557554398C638545259265B1C	B82159FE3D3DDDAE92AD2D67DC26392C5321619F	1124D13214401DA2616D9CB4A241A79839BD9347AC247EFFFCBDC453012C23F7
/run/systemd/users/.#127nNTceg	ASCII text	F56A4BA35B2B1951336F8001222B1465	3053941825CC79B4D369E85F546400F24C8075A9	7023ECE349D886D07F780BE205D454F9FD34247EEE5C426B2B4F636B48D3625B
/run/systemd/users/.#127ncdj1c	ASCII text	C8525C9A48153799FB12697143C4FB7A	9837038C47F293BB09C35780936FA576A9A1CC3C	9E99D049B83DD50181F349C01ED502127BE2A7645402863337BE630B58CC80D8
/run/systemd/users/.#127qdw6VQ	ASCII text	F031ACC3666C9383BBB301D3BBC010CB	3ACE50255A18D26D7437F59AADD953E50F485207	D2A3D73878A2E04F952B5FBEA9F12B760FC8E73F48DD20BB0B83553D361B83C1
/run/systemd/users/.#127vmUZMe	ASCII text	3CA83C9BBDA182BA98A09B7C52C0FD90	C0762D1C4B612A00756EF7BEEFDA6607A2C99357	E0AFE0F7278A0FC4EDEC39ED70F42488D174793BCA58B11649C3513367F10715
/run/systemd/users/.#127wmkYZc	ASCII text	F56A4BA35B2B1951336F8001222B1465	3053941825CC79B4D369E85F546400F24C8075A9	7023ECE349D886D07F780BE205D454F9FD34247EEE5C426B2B4F636B48D3625B
/run/systemd/users/.#127zYpbOc	ASCII text	EBC5FE6CC78BC17C3915AF5AE1DB229F	76ECFE8ED33C6EC92E2421F61B1629191BBB6161	D974D9F33A91EFEAEDEE50016F89493756E06A41CE372BCA36A859D2A09A8709
/run/user/1000/pulse/pid	ASCII text	D4F1C451BC750FB2F895D796E8106B4E	A2019EBD4D455FED13F64959C74C6803096731A0	BA78157001114584B29C6BE71A21C7325403642957FF388397C3BB9632EEADD5
/run/user/127/ICEauthority	data	F874E06F05EEAA73421F702D4BC8B95F	EA761AA91A2AA5DA1543D14F278EFA6152A9C833	FC1DE1C81CAE8E41D7E57ADD3D9887E420E8F49B5A1F6AC9B00F51CF253B29AD
/run/user/127/dconf/user	very short file (no magic)	93B885ADFE0DA089CDF634904FD59F71	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
/run/user/127/gdm/Xauthority	X11 Xauthority data	54DA8435E6EF2714874D79338648A353	0DF074DBBB8FBEB0452A49C0583FA3ADD2A1676A	977B1A60B2BA356A8B88522FF65AED1CD4FCD4F7113EBAEEC25F1B5EFC05EC44
/run/user/127/pulse/pid	ASCII text	6BC7E7462D1901466CAD422F99FFE2DA	7CD1494FC0C6D638442C0347CCD7725DE4A138EA	25904C6AA3F4CADBE2F2C8A5547E7F5727508F02776EFA8CAA86DAA885DD9DA3
/run/utmp	data	E55B9A800BF7918A2668A8871BFDF1B0	D5ED2F63A2E5AF22480A7292E2636D44F4FEAF09	CA90C031DFA3176FB8884C6FDEC9CD63664B0A54015A57DA42ECEBF210E55CE0
/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs	ASCII text	D532A2EC2176417E1AD04C90B6DD296C	91C0D29D08D683A6D9796EAA8BAA6C01756BB644	E65E7838A1D5D7797D891D7EC5E667899687D81763460E58B22F22ED615F39B3
/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs	ASCII text	B4B3528DD3B59343AC1C65E599050A06	99A13D1F2CF4A7CCF2D6C5E6740F627B4F5C7A2A	3AD13A70183D0E9ACCF19EAAE3FB74A3267CAB89CF9F6318D50A659D0594C13B
/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs	ASCII text	852E1973DCF3D424EB92A615D5DD7635	9E1B2878D50F3ED21D9FD945EAB8A759C4706030	EB0B02A06DBA8DAFB75D4DBD84EA1EA16A7A941E09ED0760E89491D34B5C8D19
/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs	ASCII text	6BC7E7462D1901466CAD422F99FFE2DA	7CD1494FC0C6D638442C0347CCD7725DE4A138EA	25904C6AA3F4CADBE2F2C8A5547E7F5727508F02776EFA8CAA86DAA885DD9DA3
/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs	ASCII text	D532A2EC2176417E1AD04C90B6DD296C	91C0D29D08D683A6D9796EAA8BAA6C01756BB644	E65E7838A1D5D7797D891D7EC5E667899687D81763460E58B22F22ED615F39B3
/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs	ASCII text	B4B3528DD3B59343AC1C65E599050A06	99A13D1F2CF4A7CCF2D6C5E6740F627B4F5C7A2A	3AD13A70183D0E9ACCF19EAAE3FB74A3267CAB89CF9F6318D50A659D0594C13B
/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs	ASCII text	852E1973DCF3D424EB92A615D5DD7635	9E1B2878D50F3ED21D9FD945EAB8A759C4706030	EB0B02A06DBA8DAFB75D4DBD84EA1EA16A7A941E09ED0760E89491D34B5C8D19
/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs	ASCII text	6BC7E7462D1901466CAD422F99FFE2DA	7CD1494FC0C6D638442C0347CCD7725DE4A138EA	25904C6AA3F4CADBE2F2C8A5547E7F5727508F02776EFA8CAA86DAA885DD9DA3
/tmp/qemu-open.fDts8u (deleted)	data	713FE762BE989CB978FC94403F8F683B	66D8706274922B5D28DB4A054DA073596CE053B1	97E2C8CAA0FE350C32A72DC308036B9F5721AF04547BAFE79E078F329CDCD775
/tmp/server-0.xkm	Compiled XKB Keymap: lsb, version 15	AC37A4B84E9FB5FE9E63CE9367F31371	E2D70CE4A01CB5F80F0C8B63EE856AE6FE8B0EFA	143E089EE7EB5E9BF088C19FC59A0EA7ED061AD3AE3E3CB5BC63BDFD86833DFF
/var/lib/AccountsService/users/gdm.AXM8W2	ASCII text	542BA3FB41206AE43928AF1C5E61FEBC	F56F574DAF50D609526B36B5B54FDD59EA4D6A26	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
/var/lib/AccountsService/users/gdm.POVGX2	ASCII text	542BA3FB41206AE43928AF1C5E61FEBC	F56F574DAF50D609526B36B5B54FDD59EA4D6A26	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0	ASCII text	F62AFFA00A155DE68CD7235959EBD8D5	11EDACE2168E6FFEE0035ABEFECECE6F06B6B4D7	85D399EA3C531F89BC04FB3F2FDACCAA3480B4D5EF2B9362E43FF456BF084844
/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink	very short file (no magic)	68B329DA9893E34099C7D8AD5CB9C940	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source	very short file (no magic)	68B329DA9893E34099C7D8AD5CB9C940	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
/var/lib/ubuntu-drivers-common/last_gfx_boot	ASCII text	078760523943E160756979906B85FB5E	0962643266F4C5537F7D125046F28F21D6DD0C89	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
/var/log/Xorg.0.log	JSON data	ABEF8319343D028E7F70A9494A7D62DE	96629353B93CD21E9BC8C7DAA12665C16A0283A6	903EB3636B2BA36870D7D2A216811DCC667CB07BC5F98013DD7F08FC7510B377
/var/log/auth.log	ASCII text	80A87A1636B2A6736D8FF16FE18C2F02	56507EEE600B98B4BD67D51B1ED838EEF9A93344	2673529CFF2E24B76B940A35DBF07A7782059F8FF7BF23627250B61A3456C06A
/var/log/gpu-manager.log	ASCII text	3AF77E630DA00B3BE24F4E8AA5D78B13	BCF2D99E002F6DE2413A183227B011CFBEF5673D	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal	data	EA3BF750AA8A89FEAEE208356A3E0975	DFFDBF3D3BE8A50258F8C190870DEE5D58D58E1A	6572C59A19AD541938A3679B6DEDD272862269AB13A17E9BE238F7D552DF7D65
/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal	data	F826420C45C7CC370EC7FC25B2449A2A	89BFA311FFCBA5F38331FBD7076B99DDDF9AA288	E7F985EB011F09E81A20DECC9BCDAAB17C874749BA20BAA0D50BE402EFCC11E2
/var/log/kern.log	ASCII text	4A0A8A56B2A2B5CF0781F26BF724F8DD	1F2E4C831891C6E50CC81A9B1858E114D107DE7A	22A6E4E51A39B75EC24BD7AC2010A6CB8D65D6F31ECCA88710B0BD5365295838
/var/log/syslog	ASCII text, with very long lines (317)	63F62B7B8E87FC3EDA1EB1E1DD2862A9	711F10A84FE22BA560E2574A7716A9A4AD308966	A7ED967F2F4F1C9FF5FCA76C6803D2CB191CE0B182080759C4D1FD34D32F61F2
/var/log/wtmp	data	E55B9A800BF7918A2668A8871BFDF1B0	D5ED2F63A2E5AF22480A7292E2636D44F4FEAF09	CA90C031DFA3176FB8884C6FDEC9CD63664B0A54015A57DA42ECEBF210E55CE0

Linux Analysis Report
vqsjh4.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Linux Analysis Report vqsjh4.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Linux Analysis Report
vqsjh4.elf

Malware Threat Intel
Provided by