Linux Analysis Report
vkjqpc.elf

Overview

General Information

Sample name: vkjqpc.elf
Analysis ID: 1560637
MD5: 5c577c051d86c9e78be3278fe982f98b
SHA1: 7bb1697b41891de5a6007811d9bcbe23f69b21a6
SHA256: 3e4410cf69e2a10499aa4c2e5ffb72e909783cb9aa5fb76fab7d709454625b8c
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Yara detected Mirai
Reads system files that contain records of logged in users
Sample deletes itself
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Sends malformed DNS queries
Creates hidden files and/or directories
Deletes log files
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Executes the "ps" command used to list the status of processes
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
HTTP GET or POST without a user agent
Reads CPU information from /sys indicative of miner or evasive malware
Reads system information from the proc file system
Reads system version information
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: vkjqpc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: vkjqpc.elf ReversingLabs: Detection: 50%
Source: vkjqpc.elf Virustotal: Detection: 39% Perma Link
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/ps (PID: 6408) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/ps (PID: 6825) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6499) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 6607) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 6725) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 6836) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6988) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7041) Reads CPU info from /sys: /sys/devices/system/cpu/online
Found strings indicative of a multi-platform dropper
Source: vkjqpc.elf String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking
barindex
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: ksdjwi.eye-network.ru. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic TCP traffic: 192.168.2.23:49662 -> 154.216.16.109:33966
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue
Reads the 'hosts' file potentially containing internal network hosts
Source: /usr/sbin/rsyslogd (PID: 6502) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6636) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6733) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6804) Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6960) Reads hosts file: /etc/hosts
Sample listens on a socket
Source: /lib/systemd/systemd-journald (PID: 6480) Socket: unknown address family Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6614) Socket: unknown address family Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) Socket: unknown address family Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6845) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6868) Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6958) Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7000) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7027) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7035) Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7023) Socket: unknown address family
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: global traffic DNS traffic detected: DNS query: ksdjwi.eye-network.ru
Source: global traffic DNS traffic detected: DNS query: ksdjwi.eye-network.ru. [malformed]
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknown HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue
Source: syslog.119.dr, syslog.292.dr, syslog.171.dr, syslog.43.dr, syslog.183.dr String found in binary or memory: https://www.rsyslog.com
Source: unknown Network traffic detected: HTTP traffic on port 38376 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 38376
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: vkjqpc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6236.1.00007fa454001000.00007fa454024000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: vkjqpc.elf PID: 6236, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample tries to kill a massive number of system processes
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 141, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 144, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 157, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 201, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 208, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 209, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 210, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 211, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 212, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 213, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 214, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 215, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 216, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 217, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 218, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 219, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 220, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 221, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 222, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 223, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 225, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 226, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 228, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 230, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 232, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 236, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 237, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 278, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 281, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 286, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 333, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 346, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 379, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 420, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 491, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 517, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 654, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 655, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 656, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 657, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 658, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 667, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 670, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 675, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 676, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 677, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 720, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 721, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 759, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 761, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 772, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 774, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 777, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 785, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 788, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 789, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 793, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 796, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 797, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 799, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 800, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 801, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 840, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 847, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 884, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 896, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 904, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 910, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 912, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 918, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent to PID below 1000: pid: 936, result: successful Jump to behavior
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1638, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6242, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 141, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 144, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 157, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 201, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 208, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 209, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 210, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 211, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 212, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 213, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 214, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 215, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 217, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 218, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 346, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 379, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 420, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 491, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 517, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 654, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 655, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 656, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 657, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 667, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 670, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 675, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 677, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 721, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 761, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 772, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 774, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 785, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 788, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 789, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 793, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 796, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 797, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 799, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 800, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 801, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 840, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 847, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 884, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 896, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 904, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 910, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 912, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 918, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1207, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1320, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1344, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1349, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1599, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1699, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1809, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1877, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1886, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1888, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1890, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1900, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1983, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2009, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2014, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2018, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2025, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2028, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2033, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2038, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2048, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2050, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2062, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2063, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2069, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2074, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2077, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2078, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2079, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2080, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2083, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2084, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2096, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2097, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2102, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2114, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2123, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2126, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2128, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2129, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2146, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2156, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2195, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2223, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2226, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2235, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2242, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2275, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2281, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2285, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2289, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2294, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2302, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2307, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2637, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2746, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2749, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2761, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2882, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 3021, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 3088, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 3236, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4390, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4444, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4445, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4446, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4447, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4495, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4501, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4526, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6070, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6182, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6189, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6192, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6198, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6220, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6221, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6249, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6251, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6252, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6253, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6254, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6255, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6256, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6257, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6258, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6259, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6260, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6261, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6262, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6263, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6264, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6265, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6266, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6267, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6398, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6399, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6400, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6402, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6408, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6498, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6499, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6500, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6502, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6582, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6614, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6633, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6635, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6636, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6639, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6480, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6653, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6726, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6729, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6730, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6733, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6738, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1334, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1335, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6220, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6221, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6499, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6742, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6745, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6802, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6803, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6804, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6805, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6822, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6825, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6845, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6891, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6892, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6894, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6895, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6949, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6950, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: BusyBox
Source: Initial sample String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1638, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6242, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 141, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 144, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 157, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 201, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 208, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 209, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 210, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 211, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 212, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 213, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 214, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 215, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 217, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 218, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 346, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 379, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 420, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 491, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 517, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 654, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 655, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 656, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 657, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 667, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 670, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 675, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 677, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 721, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 761, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 772, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 774, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 785, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 788, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 789, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 793, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 796, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 797, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 799, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 800, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 801, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 840, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 847, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 884, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 896, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 904, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 910, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 912, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 918, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1207, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1320, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1344, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1349, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1599, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1699, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1809, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1877, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1886, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1888, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1890, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1900, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1983, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2009, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2014, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2018, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2025, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2028, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2033, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2038, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2048, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2050, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2062, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2063, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2069, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2074, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2077, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2078, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2079, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2080, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2083, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2084, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2096, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2097, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2102, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2114, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2123, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2126, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2128, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2129, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2146, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2156, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2195, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2223, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2226, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2235, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2242, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2275, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2281, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2285, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2289, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2294, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2302, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2307, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2637, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2746, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2749, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2761, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 2882, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 3021, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 3088, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 3236, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4390, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4444, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4445, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4446, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4447, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4495, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4501, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 4526, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6070, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6182, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6189, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6192, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6198, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6220, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6221, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6249, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6251, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6252, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6253, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6254, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6255, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6256, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6257, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6258, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6259, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6260, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6261, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6262, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6263, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6264, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6265, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6266, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6267, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6398, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6399, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6400, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6402, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6408, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6498, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6499, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6500, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6502, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6582, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6614, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6633, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6635, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6636, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6639, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6480, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6653, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6726, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6729, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6730, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6733, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6738, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1334, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 1335, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6220, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6221, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6499, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6742, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6745, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6802, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6803, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6804, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6805, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6822, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6825, result: no such process Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6845, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6891, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6892, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6894, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6895, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6949, result: successful Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240) SIGKILL sent: pid: 6950, result: successful Jump to behavior
Yara signature match
Source: vkjqpc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6236.1.00007fa454001000.00007fa454024000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: vkjqpc.elf PID: 6236, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.spre.troj.evad.linELF@0/146@134/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 6500) File: /proc/6500/mounts Jump to behavior
Source: /bin/fusermount (PID: 6594) File: /proc/6594/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6639) File: /proc/6639/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6738) File: /proc/6738/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6805) File: /proc/6805/mounts
Source: /usr/bin/dbus-daemon (PID: 6868) File: /proc/6868/mounts
Source: /usr/bin/dbus-daemon (PID: 6875) File: /proc/6875/mounts
Source: /usr/bin/dbus-daemon (PID: 6891) File: /proc/6891/mounts
Source: /usr/bin/dbus-daemon (PID: 6959) File: /proc/6959/mounts
Source: /usr/bin/dbus-daemon (PID: 7027) File: /proc/7027/mounts
Source: /usr/bin/dbus-daemon (PID: 7035) File: /proc/7035/mounts
Source: /usr/bin/dbus-daemon (PID: 7049) File: /proc/7049/mounts
Creates hidden files and/or directories
Source: /usr/libexec/gsd-rfkill (PID: 6242) Directory: <invalid fd (9)>/.. Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6242) Directory: <invalid fd (8)>/.. Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6249) Directory: <invalid fd (10)>/.. Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76023qdZKjc Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76026LdebEc Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76157EaUxla Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:75703Ccg7x9 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:75718hYkbGb Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:764247BvMw9 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:764261mY1O9 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76553lNjp9a Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76651j4b6zd Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76658Opsora Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76670IX8sya Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76677pJCtOd Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:76756tjufTd Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:778809RweMb Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:77915yj10qb Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:77916zlcAU9 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:77934wCZSC9 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:78130snG7Id Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:78142RIDYdd Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:782802zH7Ua Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:78325uC3Hua Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:79192dYjvca Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:78386EQv7Ma Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) File: /run/systemd/journal/streams/.#9:79383vPqPAb Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509) File: /run/systemd/seats/.#seat0T23q6m Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6572) Directory: /root/.cache Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618) Directory: /var/lib/gdm3/.pam_environment Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618) Directory: /root/.cache Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6653) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6653) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6653) File: /run/systemd/seats/.#seat0noSHCe Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:79806nLDkP0 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:79807Xrbw60 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:79815lwIjb2 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:79821pSAKBY Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:79827psxzuZ Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:798368Tspb1 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:79837cbdN4X Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80939r7seWZ Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80222bfx5q1 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80316EkvAKZ Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80334ufdhS1 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80359RQo9W0 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80361PRnDWX Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80391amQCuY Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80392Kg05rZ Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:812788pPs0Y Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:813213jU740 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) File: /run/systemd/journal/streams/.#9:80810MNaO4Y Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6745) Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6745) Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6745) File: /run/systemd/seats/.#seat01okSCf
Source: /lib/systemd/systemd-logind (PID: 6745) File: /run/systemd/users/.#127tg557b
Source: /lib/systemd/systemd-logind (PID: 6745) File: /run/systemd/users/.#127q8Rsoc
Source: /lib/systemd/systemd-logind (PID: 6745) File: /run/systemd/seats/.#seat0CI8n5d
Source: /lib/systemd/systemd-logind (PID: 6745) File: /run/systemd/users/.#127hbGgBf
Source: /lib/systemd/systemd-logind (PID: 6745) File: /run/systemd/users/.#1274xBuhd
Source: /lib/systemd/systemd-logind (PID: 6745) File: /run/systemd/users/.#127lKvyWb
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6866) Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849) Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849) Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6858) Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 6899) Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6899) Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6899) File: /run/systemd/seats/.#seat0C0Gl2T
Source: /lib/systemd/systemd-logind (PID: 6899) File: /run/systemd/users/.#127NimYKS
Source: /lib/systemd/systemd-logind (PID: 6899) File: /run/systemd/users/.#127gCNrFS
Source: /lib/systemd/systemd-logind (PID: 6899) File: /run/systemd/seats/.#seat01ax7uQ
Source: /lib/systemd/systemd-logind (PID: 6899) File: /run/systemd/users/.#127npF7RT
Source: /lib/systemd/systemd-logind (PID: 6899) File: /run/systemd/users/.#127N0bxbQ
Source: /lib/systemd/systemd-logind (PID: 6899) File: /run/systemd/users/.#127sb3zDR
Source: /lib/systemd/systemd-logind (PID: 6899) File: /run/systemd/users/.#127GlMhLT
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:81883C5jxik
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:81884o2WO9j
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:81885NpMDVk
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:81892gAsCBm
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:81899e9HWPj
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:819008H0uUm
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:81906ent2Ui
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:81914JFZXqm
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:81920FByXFi
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:829459iP4Jk
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:830205Bi3Rm
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:83031WwSxFl
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:831266k4J4i
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:83171ry8iEi
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:83173BMB08l
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:82913dMVLjl
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:82924XIjMBj
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:82925DWpfHi
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:84061cTyZJl
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:84066lG04uk
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:84072Axu2Ij
Source: /lib/systemd/systemd-journald (PID: 6958) File: /run/systemd/journal/streams/.#9:8412967yg8i
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7025) Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004) Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004) Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7013) Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7023) Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7023) Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7023) Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7023) Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7023) Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7023) Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7023) Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7023) Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7029) Directory: <invalid fd (4)>/.config
Enumerates processes within the "proc" file system
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7028/comm
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7049/stat
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7049/comm
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7049/cgroup
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7040/comm
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7040/cgroup
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7041/stat
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7041/cgroup
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7041/cgroup
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/7041/comm
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/1/environ
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/1/sched
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7023) File opened: /proc/1/comm
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/3088/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/3088/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/230/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/230/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/232/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/232/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/236/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/236/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/237/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/237/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/910/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/910/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/6240/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/6240/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/126/status
Source: /usr/bin/pkill (PID: 6988) File opened: /proc/126/cmdline
Executes commands using a shell command-line interpreter
Source: /tmp/vkjqpc.elf (PID: 6402) Shell command executed: sh -c "ps -e -o pid,args=" Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6822) Shell command executed: sh -c "ps -e -o pid,args=" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6577) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6583) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6590) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6592) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6600) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6624) Shell command executed: sh -c "locale -a | grep -F .utf8 " Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6644) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6646) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6648) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6710) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6713) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6716) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6720) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6722) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6811) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6813) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6815) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6817) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6819) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6824) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6830) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6832) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6855) Shell command executed: sh -c "locale -a | grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6968) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6971) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6973) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6975) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6978) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6981) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6983) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6985) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7010) Shell command executed: sh -c "locale -a | grep -F .utf8 "
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 6581) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6584) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6587) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6589) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6591) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6593) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6599) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6601) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6626) Grep executable: /usr/bin/grep -> grep -F .utf8 Jump to behavior
Source: /bin/sh (PID: 6645) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6647) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6649) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6711) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6714) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6717) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6721) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6723) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6812) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6814) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6816) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6818) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6820) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6826) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6831) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6833) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6857) Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6969) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6972) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6974) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6976) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6979) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6982) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6984) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6986) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7012) Grep executable: /usr/bin/grep -> grep -F .utf8
Executes the "kill" or "pkill" command typically used to terminate processes
Source: /usr/share/gdm/generate-config (PID: 6607) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6725) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6836) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6988) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Executes the "ps" command used to list the status of processes
Source: /bin/sh (PID: 6408) Ps executable: /usr/bin/ps -> ps -e -o pid,args= Jump to behavior
Source: /bin/sh (PID: 6825) Ps executable: /usr/bin/ps -> ps -e -o pid,args= Jump to behavior
Executes the "systemctl" command used for controlling the systemd system and service manager
Source: /lib/systemd/systemd (PID: 7040) Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus
Reads system information from the proc file system
Source: /usr/bin/ps (PID: 6408) Reads from proc file: /proc/meminfo Jump to behavior
Source: /usr/bin/ps (PID: 6825) Reads from proc file: /proc/meminfo Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) Reads from proc file: /proc/meminfo Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) Reads from proc file: /proc/meminfo Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6958) Reads from proc file: /proc/meminfo
Reads system version information
Source: /sbin/agetty (PID: 6582) Reads version info: /etc/issue Jump to behavior
Source: /sbin/agetty (PID: 6635) Reads version info: /etc/issue Jump to behavior
Source: /sbin/agetty (PID: 6802) Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6896) Reads version info: /etc/issue
Sample tries to set the executable flag
Source: /usr/sbin/gdm3 (PID: 6614) File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6614) File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx) Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6845) File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6845) File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7000) File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7000) File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/rsyslogd (PID: 6502) Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6502) Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6575) Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6636) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6636) Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6643) Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6733) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6804) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6804) Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6810) Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6960) Log file created: /var/log/kern.log Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6960) Log file created: /var/log/auth.log Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6964) Log file created: /var/log/gpu-manager.log Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/vkjqpc.elf (PID: 6238) File: /tmp/vkjqpc.elf Jump to behavior
Deletes log files
Source: /usr/bin/gpu-manager (PID: 6575) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6643) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6810) Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6964) Truncated file: /var/log/gpu-manager.log
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/ps (PID: 6408) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/ps (PID: 6825) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6499) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 6607) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 6725) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 6836) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6988) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7041) Reads CPU info from /sys: /sys/devices/system/cpu/online
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/vkjqpc.elf (PID: 6236) Queries kernel information via 'uname': Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6249) Queries kernel information via 'uname': Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6499) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6502) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6575) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 6582) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6627) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 6635) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6636) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6643) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6733) Queries kernel information via 'uname': Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 6802) Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6804) Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6810) Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6862) Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6896) Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6958) Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6960) Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6964) Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7017) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7041) Queries kernel information via 'uname':
Source: vkjqpc.elf, 6236.1.000055797100e000.00005579710be000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/vkjqpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/vkjqpc.elf
Source: kern.log.292.dr Binary or memory string: Nov 21 21:00:44 galassia kernel: [ 590.701346] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp Binary or memory string: /tmp/qemu-open.gTYa1K
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp Binary or memory string: myU/tmp/qemu-open.gTYa1K\D
Source: vkjqpc.elf, 6236.1.000055797100e000.00005579710be000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp Binary or memory string: %s/qemu-op
Source: kern.log.292.dr Binary or memory string: Nov 21 21:00:44 galassia kernel: [ 590.701372] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp Binary or memory string: MPDIR%s/qemu-op

Language, Device and Operating System Detection
barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618) Logged in records file read: /var/log/wtmp Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849) Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004) Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: vkjqpc.elf, type: SAMPLE
Source: Yara match File source: 6236.1.00007fa454001000.00007fa454024000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vkjqpc.elf PID: 6236, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: vkjqpc.elf, type: SAMPLE
Source: Yara match File source: 6236.1.00007fa454001000.00007fa454024000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vkjqpc.elf PID: 6236, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.213.35.24
 unknown United States
41231 CANONICAL-ASGB false
89.190.156.145
 unknown United Kingdom
7489 HOSTUS-GLOBAL-ASHostUSHK false
154.216.16.109
 ksdjwi.eye-network.ru Seychelles
135357 SKHT-ASShenzhenKatherineHengTechnologyInformationCo false
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
ksdjwi.eye-network.ru 154.216.16.109 true
ksdjwi.eye-network.ru. [malformed] unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e false
    		high