Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1527293
MD5: e6718d618bf29c3adc96d6bb20698261
SHA1: 356af267276553427c895b739c92c233635a6021
SHA256: 7022bf8444420bf01377e40835020fc284f902163c6997933e083a0f21c52f42
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 96
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Yara detected Mirai
Yara detected Okiru
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Uses known network protocols on non-standard ports
Creates hidden files and/or directories
Deletes log files
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Found strings indicative of a multi-platform dropper
Reads CPU information from /sys indicative of miner or evasive malware
Reads system version information
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 66%
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pulseaudio (PID: 5482) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5589) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5727) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5767) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5994) Reads CPU info from /sys: /sys/devices/system/cpu/online
Found strings indicative of a multi-platform dropper
Source: na.elf String: 'byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45302
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45564
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45602
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:37410 -> 154.216.20.119:777
Reads the 'hosts' file potentially containing internal network hosts
Source: /usr/sbin/rsyslogd (PID: 5483) Reads hosts file: /etc/hosts Jump to behavior
Sample listens on a socket
Source: /usr/sbin/gdm3 (PID: 5595) Socket: unknown address family Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5628) Socket: unknown address family Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5629) Socket: unknown address family Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5704) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5726) Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5707) Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5926) Socket: unknown address family
Source: unknown TCP traffic detected without corresponding DNS query: 41.160.125.197
Source: unknown TCP traffic detected without corresponding DNS query: 166.51.13.197
Source: unknown TCP traffic detected without corresponding DNS query: 176.38.26.119
Source: unknown TCP traffic detected without corresponding DNS query: 91.226.205.110
Source: unknown TCP traffic detected without corresponding DNS query: 24.67.20.244
Source: unknown TCP traffic detected without corresponding DNS query: 82.204.104.30
Source: unknown TCP traffic detected without corresponding DNS query: 23.227.44.70
Source: unknown TCP traffic detected without corresponding DNS query: 200.245.132.145
Source: unknown TCP traffic detected without corresponding DNS query: 131.190.90.59
Source: unknown TCP traffic detected without corresponding DNS query: 194.63.94.140
Source: unknown TCP traffic detected without corresponding DNS query: 116.76.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 168.95.135.173
Source: unknown TCP traffic detected without corresponding DNS query: 14.91.14.55
Source: unknown TCP traffic detected without corresponding DNS query: 46.251.156.175
Source: unknown TCP traffic detected without corresponding DNS query: 148.105.124.203
Source: unknown TCP traffic detected without corresponding DNS query: 24.226.8.2
Source: unknown TCP traffic detected without corresponding DNS query: 27.72.93.212
Source: unknown TCP traffic detected without corresponding DNS query: 159.249.31.184
Source: unknown TCP traffic detected without corresponding DNS query: 12.198.161.241
Source: unknown TCP traffic detected without corresponding DNS query: 24.253.132.217
Source: unknown TCP traffic detected without corresponding DNS query: 14.1.46.98
Source: unknown TCP traffic detected without corresponding DNS query: 87.85.131.141
Source: unknown TCP traffic detected without corresponding DNS query: 1.19.56.159
Source: unknown TCP traffic detected without corresponding DNS query: 139.150.178.175
Source: unknown TCP traffic detected without corresponding DNS query: 48.111.87.74
Source: unknown TCP traffic detected without corresponding DNS query: 46.98.27.254
Source: unknown TCP traffic detected without corresponding DNS query: 94.205.126.69
Source: unknown TCP traffic detected without corresponding DNS query: 5.3.61.186
Source: unknown TCP traffic detected without corresponding DNS query: 128.212.162.24
Source: unknown TCP traffic detected without corresponding DNS query: 117.49.101.63
Source: unknown TCP traffic detected without corresponding DNS query: 168.249.184.238
Source: unknown TCP traffic detected without corresponding DNS query: 174.121.153.78
Source: unknown TCP traffic detected without corresponding DNS query: 17.17.117.139
Source: unknown TCP traffic detected without corresponding DNS query: 2.203.60.196
Source: unknown TCP traffic detected without corresponding DNS query: 168.108.121.217
Source: unknown TCP traffic detected without corresponding DNS query: 77.121.25.12
Source: unknown TCP traffic detected without corresponding DNS query: 36.165.215.189
Source: unknown TCP traffic detected without corresponding DNS query: 126.149.97.170
Source: unknown TCP traffic detected without corresponding DNS query: 191.174.168.59
Source: unknown TCP traffic detected without corresponding DNS query: 171.8.124.203
Source: unknown TCP traffic detected without corresponding DNS query: 71.33.54.169
Source: unknown TCP traffic detected without corresponding DNS query: 125.56.45.90
Source: unknown TCP traffic detected without corresponding DNS query: 220.22.245.153
Source: unknown TCP traffic detected without corresponding DNS query: 153.135.165.41
Source: unknown TCP traffic detected without corresponding DNS query: 185.56.29.238
Source: unknown TCP traffic detected without corresponding DNS query: 216.49.171.199
Source: unknown TCP traffic detected without corresponding DNS query: 72.192.181.130
Source: unknown TCP traffic detected without corresponding DNS query: 77.58.176.124
Source: unknown TCP traffic detected without corresponding DNS query: 147.219.185.254
Source: unknown TCP traffic detected without corresponding DNS query: 174.39.200.127
Source: global traffic DNS traffic detected: DNS query: byte-mirai.kro.kr
Source: Xorg.0.log.151.dr, syslog.26.dr String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.151.dr, syslog.26.dr String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.26.dr String found in binary or memory: https://www.rsyslog.com

System Summary
barindex
Sample tries to kill a massive number of system processes
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 783, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 795, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent to PID below 1000: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent to PID below 1000: pid: 936, result: successful Jump to behavior
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 783, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 795, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1805, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 2970, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3703, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3704, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3705, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3706, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3715, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 5415, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 5431, result: unknown Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1805, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3703, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3704, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3705, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3706, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3715, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 5434, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 5437, result: unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5704) SIGKILL sent: pid: 5720, result: successful
Source: /usr/bin/dbus-daemon (PID: 5704) SIGKILL sent: pid: 5946, result: successful
Source: /usr/bin/dbus-daemon (PID: 5704) SIGKILL sent: pid: 6120, result: successful
Source: /usr/bin/dbus-daemon (PID: 5726) SIGKILL sent: pid: 5999, result: successful
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: 'byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 783, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 795, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 1805, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 2970, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3703, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3704, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3705, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3706, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 3715, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 5415, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5431) SIGKILL sent: pid: 5431, result: unknown Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 1805, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3703, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3704, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3705, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3706, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 3715, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 5434, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5437) SIGKILL sent: pid: 5437, result: unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5704) SIGKILL sent: pid: 5720, result: successful
Source: /usr/bin/dbus-daemon (PID: 5704) SIGKILL sent: pid: 5946, result: successful
Source: /usr/bin/dbus-daemon (PID: 5704) SIGKILL sent: pid: 6120, result: successful
Source: /usr/bin/dbus-daemon (PID: 5726) SIGKILL sent: pid: 5999, result: successful
Source: classification engine Classification label: mal96.spre.troj.linELF@0/96@3/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 5481) File: /proc/5481/mounts Jump to behavior
Source: /bin/fusermount (PID: 5484) File: /proc/5484/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5575) File: /proc/5575/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5628) File: /proc/5628/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5704) File: /proc/5704/mounts
Source: /usr/bin/dbus-daemon (PID: 5726) File: /proc/5726/mounts
Source: /usr/bin/gjs (PID: 6121) File: /proc/6121/mounts
Source: /usr/bin/gnome-shell (PID: 5767) File: /proc/5767/mounts
Source: /usr/bin/dbus-daemon (PID: 5625) File: /proc/5625/mounts
Creates hidden files and/or directories
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat06IdSjW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127srH9JX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127dav0WV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (20)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (19)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0Xo91UT Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127jZyuhW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1V8SHPW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127cRkriX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat003yFDV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127mKzAwW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c14WEsfY Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1AddulX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127cnsaAU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1tpi29X Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1u9I7AW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1cmFh2X Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127vQROgW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat07IjKMX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127HLuJQT Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0rBsjPV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127sFv3dY Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0tHuFqV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127cK93OX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2hrKB2X Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127FDHVFT Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0KpuuUX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2CsredW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2fNLWXU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127GP93pW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2SdHqTX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (21)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (20)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2UwvxsU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (21)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2a2eg7V Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2SbGjbW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (24)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c28Qt0bY Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/inhibit/.#1ITVSTV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/inhibit/.#29ScS2W Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/inhibit/.#37BJ6IX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/inhibit/.#4gOVR4U Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5558) Directory: /root/.cache Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5651) Directory: <invalid fd (11)>/.. Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5651) Directory: <invalid fd (10)>/.. Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685) Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5685) Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708) Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5727) Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737) Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5767) Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5767) Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5767) Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5767) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5767) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5767) Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5767) Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 5943) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 5943) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6143) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6143) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6147) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6147) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6149) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6149) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6151) Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6151) Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157) Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6170) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6170) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601) Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601) Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 5956) Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 5956) Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6117) Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6187) Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6375) Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6390) Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6390) Directory: <invalid fd (11)>/..
Enumerates processes within the "proc" file system
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5481/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5481/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5482/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5482/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5482/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6375/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5683/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6157/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5685/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6114/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6390/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6170/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6151/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6151/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6150/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/1475/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5555/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6623/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6149/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5678/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5678/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5558/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/2926/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6605/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5615/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5615/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5956/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6141/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5791/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6187/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5595/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6443/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5651/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6002/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6002/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5498/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6346/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5994/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5994/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5994/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6147/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5629/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/1/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5707/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6117/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6117/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6116/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5623/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5601/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5767/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/238/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/239/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/5379/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/5274/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/19/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/240/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/3095/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/241/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/242/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/244/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/245/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/246/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/5/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/247/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5431) File opened: /proc/6/cmdline Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/bin/gpu-manager (PID: 5568) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5570) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5573) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5576) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5578) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5580) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5582) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5584) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5696) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 5944) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5612) Shell command executed: sh -c "locale -a | grep -F .utf8 "
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5569) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5571) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5574) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5577) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5579) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5581) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5583) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5585) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5614) Grep executable: /usr/bin/grep -> grep -F .utf8
Executes the "kill" or "pkill" command typically used to terminate processes
Source: /usr/share/gdm/generate-config (PID: 5589) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Reads system version information
Source: /sbin/agetty (PID: 5562) Reads version info: /etc/issue Jump to behavior
Sample tries to set the executable flag
Source: /usr/sbin/gdm3 (PID: 5595) File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5595) File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/rsyslogd (PID: 5483) Log file created: /var/log/kern.log Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5483) Log file created: /var/log/auth.log Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5567) Log file created: /var/log/gpu-manager.log Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5685) Log file created: /var/log/Xorg.0.log Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45302
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45464
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45564
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45602
Deletes log files
Source: /usr/bin/gpu-manager (PID: 5567) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685) Truncated file: /var/log/Xorg.pid-5685.log
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pulseaudio (PID: 5482) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5589) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5727) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5767) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5994) Reads CPU info from /sys: /sys/devices/system/cpu/online
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5429) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5482) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5483) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5562) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5567) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5615) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5629) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5678) Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5683) Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5685) Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5721) Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6000) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5707) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5727) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737) Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5767) Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 5943) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6143) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6147) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6149) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6153) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6157) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6170) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5994) Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6116) Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6117) Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6187) Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6605) Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6623) Queries kernel information via 'uname':
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.013] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.321] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.624] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.025] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.666] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.502] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.567] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.493] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.192] (--) vmware(0): vram: 4194304
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.272] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.547] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.878] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:25 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.009] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.753] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: na.elf, 5429.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5431.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5432.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5434.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5437.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5438.1.00005574f0e63000.00005574f0eea000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.770] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.918] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.602] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.878] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.171] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.617] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.449] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:41 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.420] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.716] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.277] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.587] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.903] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.242] (==) vmware(0): Default visual is TrueColor
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:41 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.377] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.406] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.023] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.494] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.500] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.520] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.336] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: na.elf, 5429.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5431.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5432.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5434.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5437.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5438.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.536] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.827] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.039] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): w.blu: 8
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.949] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.590] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.361] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.641] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.779] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.258] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.459] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.200] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.482] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.770] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.455] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.626] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.434] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.031] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.853] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.682] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 154.474] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.708] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.399] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.860] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.598] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.713] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: na.elf, 5429.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5431.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5432.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5434.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5437.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5438.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.053] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.508] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.061] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.504] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.670] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.232] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.963] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): bpp: 32
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.934] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.732] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.111] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:25 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) LoadModule: "vmware"
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.620] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.678] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.885] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.445] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 169.416] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.537] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:26 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.452] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.650] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.472] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.590] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.473] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.719] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.654] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.877] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.081] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.365] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.393] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.108] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.809] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.284] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.150] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.713] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.291] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.918] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.486] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.706] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.441] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 162.022] (==) vmware(0): Backing store enabled
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.295] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.504] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.265] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.563] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.815] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.310] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.196] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.587] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.095] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.001] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.160] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.922] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.814] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.249] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.215] (--) vmware(0): w.red: 8
Source: Xorg.0.log.151.dr Binary or memory string: [ 157.916] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.481] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.609] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.865] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.741] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.474] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.528] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.447] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.361] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.163] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.109] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.432] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.412] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.757] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: na.elf, 5431.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp Binary or memory string: tU/tmp/qemu-open.ZpUvOR
Source: Xorg.0.log.151.dr Binary or memory string: [ 157.912] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.565] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.130] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.224] (--) vmware(0): w.blu: 8
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 169.772] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr Binary or memory string: [ 169.989] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.728] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.818] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.540] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.613] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.331] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.151.dr Binary or memory string: [ 153.577] (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:41 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.200] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.671] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.650] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.570] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): depth: 24
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.792] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.253] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.511] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.637] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.546] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.737] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.656] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.436] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.658] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.617] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.969] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.236] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.017] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.463] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.798] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.609] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.404] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.848] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.327] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.309] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.313] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.551] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.787] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.344] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.929] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.371] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.914] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.955] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.067] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 153.648] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: na.elf, 5437.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp Binary or memory string: tU/tmp/qemu-open.szYMRj
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.174] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.349] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.512] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.498] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.238] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.348] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.321] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.375] (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.187] (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.079] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 169.427] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr Binary or memory string: [ 169.950] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.766] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.723] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.357] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.986] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 153.706] (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): DPI set to (96, 96)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.467] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.325] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.924] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.448] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.086] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.227] (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.749] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.605] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.628] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: na.elf, 5437.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp Binary or memory string: /tmp/qemu-open.szYMRj
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.908] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.571] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.268] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:26 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.474] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.492] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.249] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.697] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.517] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.782] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.495] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 154.040] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.871] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.896] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.594] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.854] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.579] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.840] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 157.904] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.431] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.753] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.245] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.423] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.291] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.802] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.914] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.039] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.387] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.219] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.562] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.745] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.416] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.773] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.683] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.340] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.383] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.883] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.998] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.758] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.287] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.955] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.204] (--) vmware(0): mheig: 885
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.575] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.532] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.261] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.183] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.211] (--) vmware(0): bpp: 32
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 157.920] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.489] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.387] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:25 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.803] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.662] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.024] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: na.elf, 5429.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5431.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5432.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5434.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5437.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5438.1.00005574f0e63000.00005574f0eea000.rw-.sdmp Binary or memory string: tU!/etc/qemu-binfmt/mipsel
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.491] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.559] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 161.070] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.179] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.695] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: na.elf, 5431.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp Binary or memory string: /tmp/qemu-open.ZpUvOR
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.009] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.728] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.402] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.575] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 153.628] (II) LoadModule: "vmware"
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.305] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 162.033] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.441] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.298] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.318] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.313] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.416] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 170.558] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.943] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.208] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.792] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.307] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 162.053] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.301] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 169.965] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.470] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.088] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.463] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.516] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.761] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.424] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.220] (--) vmware(0): w.grn: 8
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (WW) vmware(0): Disabling 3D support.
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.890] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.644] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.602] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.959] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.826] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.246] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.512] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.429] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 169.957] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr Binary or memory string: [ 157.924] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.632] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.704] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.524] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 160.977] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.975] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 159.069] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.353] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.257] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr Binary or memory string: [ 158.700] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)

Language, Device and Operating System Detection
barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601) Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5437.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5434.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5429.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5431.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5438.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5429, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5431, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5434, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5437.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5434.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5429.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5431.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5438.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5429, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5431, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5434, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5437.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5434.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5429.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5431.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5438.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5429, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5431, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5434, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5437.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5434.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5429.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5431.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5432.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5438.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5429, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5431, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5434, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
209.144.94.224
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
87.184.38.219
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
65.176.213.40
 unknown United States
1239 SPRINTLINKUS false
138.189.215.87
 unknown Switzerland
12511 CH-POSTNETZPostCHAGCH false
82.70.92.76
 unknown United Kingdom
13037 ZEN-ASZenInternet-UKGB false
59.239.123.33
 unknown China
2516 KDDIKDDICORPORATIONJP false
171.132.210.234
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
165.197.197.232
 unknown United States
2152 CSUNET-NWUS false
173.213.44.170
 unknown United States
53316 ASN-CHEETA-MAILUS false
186.131.227.230
 unknown Argentina
22927 TelefonicadeArgentinaAR false
157.161.177.150
 unknown Switzerland
6772 IMPNET-ASCH false
213.1.47.99
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
96.29.211.36
 unknown United States
10796 TWC-10796-MIDWESTUS false
57.63.222.41
 unknown Belgium
2686 ATGS-MMD-ASUS false
125.253.224.215
 unknown Hong Kong
38056 GLOBECOMM-HK-ASGlobecommNetworkServicesCorpTransitASI false
92.224.168.13
 unknown Germany
6805 TDDE-ASN1DE false
195.232.253.78
 unknown Germany
12663 VODAFONE-GROUPIT false
101.160.47.3
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
164.84.153.244
 unknown United States
134984 NEXTGEN-AS-APNextGenNetPtyLtdAU false
209.135.157.133
 unknown United States
6428 CDMUS false
51.142.97.176
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
79.17.204.96
 unknown Italy
3269 ASN-IBSNAZIT false
178.7.142.78
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
107.65.66.112
 unknown United States
7018 ATT-INTERNET4US false
200.227.227.132
 unknown Brazil
4230 CLAROSABR false
186.192.242.217
 unknown Brazil
53138 ConectlanInternetBR false
222.156.110.236
 unknown Taiwan; Republic of China (ROC)
7482 APOL-ASAsiaPacificOn-lineServiceIncTW false
182.249.115.27
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
163.76.244.91
 unknown France
14340 SALESFORCEUS false
201.58.44.201
 unknown Brazil
7738 TelemarNorteLesteSABR false
213.42.251.202
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
94.27.69.158
 unknown Ukraine
12530 GOLDENTELECOM-UKRAINEKyivstarPJSCUA false
201.14.164.199
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
155.19.196.171
 unknown United States
1494 DNIC-ASBLK-01494-01495US false
190.156.168.117
 unknown Colombia
10620 TelmexColombiaSACO false
138.133.158.61
 unknown United States
3269 ASN-IBSNAZIT false
38.79.86.229
 unknown United States
397525 ALPHAONE-ASUS false
43.106.75.61
 unknown Japan 4249 LILLY-ASUS false
202.212.22.138
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
136.159.124.44
 unknown Canada
33091 U-CALGARYCA false
97.205.56.195
 unknown United States
6167 CELLCO-PARTUS false
108.53.69.124
 unknown United States
701 UUNETUS false
133.218.135.80
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
39.72.248.82
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
86.175.23.201
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
32.179.230.42
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
60.156.44.35
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
136.175.129.241
 unknown Reserved
22498 PINELLAS-COUNTYUS false
174.183.54.72
 unknown United States
7922 COMCAST-7922US false
217.101.79.67
 unknown Netherlands
33915 TNF-ASNL false
172.250.116.226
 unknown United States
20001 TWC-20001-PACWESTUS false
17.232.208.214
 unknown United States
714 APPLE-ENGINEERINGUS false
90.79.30.143
 unknown France
3215 FranceTelecom-OrangeFR false
135.76.111.176
 unknown United States
18676 AVAYAUS false
155.51.135.230
 unknown United States
5647 ASN-KODAKUS false
65.163.214.143
 unknown United States
1239 SPRINTLINKUS false
17.110.130.68
 unknown United States
714 APPLE-ENGINEERINGUS false
124.83.132.226
 unknown Japan 24572 YAHOO-JP-AS-APYahooJapanJP false
116.109.198.10
 unknown Viet Nam
24086 VIETTEL-AS-VNViettelCorporationVN false
209.5.184.7
 unknown Canada
3602 AS3602-ROGERS-COMCA false
75.122.160.50
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
84.61.19.207
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
86.209.52.168
 unknown France
3215 FranceTelecom-OrangeFR false
137.252.83.122
 unknown United States
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
208.144.203.107
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
75.74.178.246
 unknown United States
7922 COMCAST-7922US false
25.61.6.21
 unknown United Kingdom
7922 COMCAST-7922US false
37.94.133.140
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
100.131.224.68
 unknown United States
21928 T-MOBILE-AS21928US false
168.235.88.18
 unknown United States
3842 RAMNODEUS false
79.167.165.54
 unknown Greece
3329 HOL-GRAthensGreeceGR false
187.164.89.41
 unknown Mexico
11888 TelevisionInternacionalSAdeCVMX false
111.132.36.131
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
41.210.115.191
 unknown unknown
29614 GHANATEL-ASGH false
182.174.45.60
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
38.151.122.157
 unknown United States
174 COGENT-174US false
17.59.155.191
 unknown United States
714 APPLE-ENGINEERINGUS false
144.9.162.163
 unknown United States
58541 CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN false
95.126.182.158
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
36.37.168.155
 unknown Cambodia
38623 VIETTELCAMBODIA-AS-APISPIXPINCAMBODIAWITHTHEBESTVERV false
107.169.197.220
 unknown Reserved
40676 AS40676US false
187.210.223.133
 unknown Mexico
8151 UninetSAdeCVMX false
17.70.140.215
 unknown United States
714 APPLE-ENGINEERINGUS false
47.255.177.103
 unknown Canada
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
4.191.205.37
 unknown United States
3356 LEVEL3US false
108.176.28.17
 unknown United States
12271 TWC-12271-NYCUS false
97.38.132.51
 unknown United States
6167 CELLCO-PARTUS false
205.53.193.253
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
109.36.132.112
 unknown Netherlands
15480 VFNL-ASVodafoneNLAutonomousSystemNL false
87.203.99.179
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
57.74.23.11
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
68.45.1.190
 unknown United States
7922 COMCAST-7922US false
185.33.22.61
 unknown Switzerland
60311 ONEFMCH false
169.13.99.33
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
80.128.29.8
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
174.200.107.217
 unknown United States
22394 CELLCOUS false
70.214.137.45
 unknown United States
6167 CELLCO-PARTUS false
113.58.178.63
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
139.90.44.15
 unknown Belgium
270 AS270US false
134.143.28.122
 unknown Netherlands
32432 COFANUS false

Contacted Domains

Name IP Active
byte-mirai.kro.kr 154.216.20.119 true