Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527293
MD5:	e6718d618bf29c3adc96d6bb20698261
SHA1:	356af267276553427c895b739c92c233635a6021
SHA256:	7022bf8444420bf01377e40835020fc284f902163c6997933e083a0f21c52f42
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527293
Start date and time:	2024-10-06 22:20:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/96@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: na.elf

Process Tree

system is lnxubuntu20

na.elf (PID: 5429, Parent: 5357, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5431, Parent: 5429)

na.elf New Fork (PID: 5432, Parent: 5429)

na.elf New Fork (PID: 5434, Parent: 5429)

na.elf New Fork (PID: 5437, Parent: 5434)

na.elf New Fork (PID: 5438, Parent: 5434)

na.elf New Fork (PID: 5441, Parent: 5434)

na.elf New Fork (PID: 5443, Parent: 5434)

na.elf New Fork (PID: 5444, Parent: 5434)

systemd New Fork (PID: 5481, Parent: 1)

dbus-daemon (PID: 5481, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5482, Parent: 2935)

pulseaudio (PID: 5482, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5483, Parent: 1)

rsyslogd (PID: 5483, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gvfsd-fuse New Fork (PID: 5484, Parent: 3122)

fusermount (PID: 5484, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5498, Parent: 1)

systemd-logind (PID: 5498, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5555, Parent: 1)

rtkit-daemon (PID: 5555, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5558, Parent: 1)

polkitd (PID: 5558, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5562, Parent: 1)

agetty (PID: 5562, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5563, Parent: 1400)

Default (PID: 5563, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5564, Parent: 1400)

Default (PID: 5564, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5565, Parent: 1400)

Default (PID: 5565, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5567, Parent: 1)

gpu-manager (PID: 5567, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5568, Parent: 5567)

sh (PID: 5568, Parent: 5567, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5569, Parent: 5568)

grep (PID: 5569, Parent: 5568, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5570, Parent: 5567)

sh (PID: 5570, Parent: 5567, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5571, Parent: 5570)

grep (PID: 5571, Parent: 5570, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5573, Parent: 5567)

sh (PID: 5573, Parent: 5567, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5574, Parent: 5573)

grep (PID: 5574, Parent: 5573, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5576, Parent: 5567)

sh (PID: 5576, Parent: 5567, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5577, Parent: 5576)

grep (PID: 5577, Parent: 5576, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5578, Parent: 5567)

sh (PID: 5578, Parent: 5567, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5579, Parent: 5578)

grep (PID: 5579, Parent: 5578, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5580, Parent: 5567)

sh (PID: 5580, Parent: 5567, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5581, Parent: 5580)

grep (PID: 5581, Parent: 5580, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5582, Parent: 5567)

sh (PID: 5582, Parent: 5567, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5583, Parent: 5582)

grep (PID: 5583, Parent: 5582, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5584, Parent: 5567)

sh (PID: 5584, Parent: 5567, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5585, Parent: 5584)

grep (PID: 5585, Parent: 5584, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5575, Parent: 2935)

dbus-daemon (PID: 5575, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5588, Parent: 1)

generate-config (PID: 5588, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5589, Parent: 5588)

pkill (PID: 5589, Parent: 5588, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5590, Parent: 1)

gdm-wait-for-drm (PID: 5590, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5595, Parent: 1)

gdm3 (PID: 5595, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5599, Parent: 5595)

plymouth (PID: 5599, Parent: 5595, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5615, Parent: 5595)

gdm-session-worker (PID: 5615, Parent: 5595, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5623, Parent: 5615)

gdm-wayland-session (PID: 5623, Parent: 5615, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5627, Parent: 5623)

dbus-run-session (PID: 5627, Parent: 5623, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5628, Parent: 5627)

dbus-daemon (PID: 5628, Parent: 5627, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5632, Parent: 5628)

dbus-daemon New Fork (PID: 5633, Parent: 5632)

false (PID: 5633, Parent: 5632, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5635, Parent: 5628)

dbus-daemon New Fork (PID: 5636, Parent: 5635)

false (PID: 5636, Parent: 5635, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5637, Parent: 5628)

dbus-daemon New Fork (PID: 5638, Parent: 5637)

false (PID: 5638, Parent: 5637, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5639, Parent: 5628)

dbus-daemon New Fork (PID: 5640, Parent: 5639)

false (PID: 5640, Parent: 5639, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5641, Parent: 5628)

dbus-daemon New Fork (PID: 5642, Parent: 5641)

false (PID: 5642, Parent: 5641, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5643, Parent: 5628)

dbus-daemon New Fork (PID: 5644, Parent: 5643)

false (PID: 5644, Parent: 5643, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5646, Parent: 5628)

dbus-daemon New Fork (PID: 5647, Parent: 5646)

false (PID: 5647, Parent: 5646, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5629, Parent: 5627)

gnome-session (PID: 5629, Parent: 5627, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5629, Parent: 5627, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5650, Parent: 5629)

session-migration (PID: 5650, Parent: 5629, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5651, Parent: 5629)

sh (PID: 5651, Parent: 5629, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5651, Parent: 5629, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5678, Parent: 5595)

gdm-session-worker (PID: 5678, Parent: 5595, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5683, Parent: 5678)

gdm-x-session (PID: 5683, Parent: 5678, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5685, Parent: 5683)

Xorg (PID: 5685, Parent: 5683, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5685, Parent: 5683, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5685, Parent: 5683, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5696, Parent: 5685)

sh (PID: 5696, Parent: 5685, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5697, Parent: 5696)

xkbcomp (PID: 5697, Parent: 5696, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 5944, Parent: 5685)

sh (PID: 5944, Parent: 5685, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5945, Parent: 5944)

xkbcomp (PID: 5945, Parent: 5944, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5702, Parent: 5683)

Default (PID: 5702, Parent: 5683, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5703, Parent: 5683)

dbus-run-session (PID: 5703, Parent: 5683, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5704, Parent: 5703)

dbus-daemon (PID: 5704, Parent: 5703, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5720, Parent: 5704)

dbus-daemon New Fork (PID: 5721, Parent: 5720)

at-spi-bus-launcher (PID: 5721, Parent: 5720, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5726, Parent: 5721)

dbus-daemon (PID: 5726, Parent: 5721, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 5999, Parent: 5726)

dbus-daemon New Fork (PID: 6000, Parent: 5999)

at-spi2-registryd (PID: 6000, Parent: 5999, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5750, Parent: 5704)

dbus-daemon New Fork (PID: 5751, Parent: 5750)

false (PID: 5751, Parent: 5750, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5753, Parent: 5704)

dbus-daemon New Fork (PID: 5754, Parent: 5753)

false (PID: 5754, Parent: 5753, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5755, Parent: 5704)

dbus-daemon New Fork (PID: 5756, Parent: 5755)

false (PID: 5756, Parent: 5755, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5757, Parent: 5704)

dbus-daemon New Fork (PID: 5758, Parent: 5757)

false (PID: 5758, Parent: 5757, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5759, Parent: 5704)

dbus-daemon New Fork (PID: 5760, Parent: 5759)

false (PID: 5760, Parent: 5759, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5761, Parent: 5704)

dbus-daemon New Fork (PID: 5762, Parent: 5761)

false (PID: 5762, Parent: 5761, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5764, Parent: 5704)

dbus-daemon New Fork (PID: 5765, Parent: 5764)

false (PID: 5765, Parent: 5764, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5946, Parent: 5704)

dbus-daemon New Fork (PID: 5947, Parent: 5946)

ibus-portal (PID: 5947, Parent: 5946, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6120, Parent: 5704)

dbus-daemon New Fork (PID: 6121, Parent: 6120)

gjs (PID: 6121, Parent: 6120, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6333, Parent: 5704)

dbus-daemon New Fork (PID: 6335, Parent: 6333)

false (PID: 6335, Parent: 6333, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5707, Parent: 5703)

gnome-session (PID: 5707, Parent: 5703, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5707, Parent: 5703, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5708, Parent: 5707)

gnome-session-check-accelerated (PID: 5708, Parent: 5707, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5727, Parent: 5708)

gnome-session-check-accelerated-gl-helper (PID: 5727, Parent: 5708, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5737, Parent: 5708)

gnome-session-check-accelerated-gles-helper (PID: 5737, Parent: 5708, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5766, Parent: 5707)

session-migration (PID: 5766, Parent: 5707, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5767, Parent: 5707)

sh (PID: 5767, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5767, Parent: 5707, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5926, Parent: 5767)

ibus-daemon (PID: 5926, Parent: 5767, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 5940, Parent: 5926)

ibus-memconf (PID: 5940, Parent: 5926, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 5942, Parent: 5926)

ibus-daemon New Fork (PID: 5943, Parent: 5942)

ibus-x11 (PID: 5943, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6165, Parent: 5926)

ibus-engine-simple (PID: 6165, Parent: 5926, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6141, Parent: 5707)

sh (PID: 6141, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6141, Parent: 5707, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6143, Parent: 5707)

sh (PID: 6143, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6143, Parent: 5707, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6147, Parent: 5707)

sh (PID: 6147, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6147, Parent: 5707, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6149, Parent: 5707)

sh (PID: 6149, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6149, Parent: 5707, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6150, Parent: 5707)

sh (PID: 6150, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6150, Parent: 5707, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6344, Parent: 6150)

gsd-print-notifications New Fork (PID: 6346, Parent: 6344)

gsd-printer (PID: 6346, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6151, Parent: 5707)

sh (PID: 6151, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6151, Parent: 5707, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6153, Parent: 5707)

sh (PID: 6153, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6153, Parent: 5707, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6154, Parent: 5707)

sh (PID: 6154, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6154, Parent: 5707, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6157, Parent: 5707)

sh (PID: 6157, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6157, Parent: 5707, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6159, Parent: 5707)

sh (PID: 6159, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6159, Parent: 5707, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6161, Parent: 5707)

sh (PID: 6161, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6161, Parent: 5707, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6166, Parent: 5707)

sh (PID: 6166, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6166, Parent: 5707, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6168, Parent: 5707)

sh (PID: 6168, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6168, Parent: 5707, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6170, Parent: 5707)

sh (PID: 6170, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6170, Parent: 5707, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6603, Parent: 5707)

sh (PID: 6603, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6603, Parent: 5707, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6611, Parent: 5707)

sh (PID: 6611, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6611, Parent: 5707, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5679, Parent: 5595)

Default (PID: 5679, Parent: 5595, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5680, Parent: 5595)

Default (PID: 5680, Parent: 5595, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5601, Parent: 1)

accounts-daemon (PID: 5601, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5610, Parent: 5601)

language-validate (PID: 5610, Parent: 5601, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5611, Parent: 5610)

language-options (PID: 5611, Parent: 5610, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5612, Parent: 5611)

sh (PID: 5612, Parent: 5611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5613, Parent: 5612)

locale (PID: 5613, Parent: 5612, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5614, Parent: 5612)

grep (PID: 5614, Parent: 5612, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5625, Parent: 1410)

dbus-daemon (PID: 5625, Parent: 1410, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5791, Parent: 1)

systemd-localed (PID: 5791, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 5956, Parent: 1)

upowerd (PID: 5956, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 5994, Parent: 1410)

pulseaudio (PID: 5994, Parent: 1410, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6002, Parent: 1)

geoclue (PID: 6002, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6114, Parent: 1)

wpa_supplicant (PID: 6114, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6116, Parent: 1)

avahi-daemon (PID: 6116, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6118, Parent: 6116)

systemd New Fork (PID: 6117, Parent: 1)

packagekitd (PID: 6117, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6137, Parent: 6117)

dpkg (PID: 6137, Parent: 6117, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6187, Parent: 1)

systemd-hostnamed (PID: 6187, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6375, Parent: 1)

colord (PID: 6375, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6605, Parent: 6375)

colord-sane (PID: 6605, Parent: 6375, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6390, Parent: 1)

ModemManager (PID: 6390, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6443, Parent: 1)

systemd-localed (PID: 6443, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6623, Parent: 1)

fprintd (PID: 6623, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5437.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5437.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5434.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5434.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5429.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5429.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5431.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5431.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5432.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5432.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5438.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5438.1.00007ff654400000.00007ff654415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5429	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5429	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5431	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5431	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5432	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5432	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5434	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5434	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5437	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5437	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5438	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5438	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 19 entries

String: 'byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 45302
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 45464
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 45564
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 45602

Source: global traffic

TCP traffic: 192.168.2.13:37410 -> 154.216.20.119:777

Source: /usr/sbin/rsyslogd (PID: 5483)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5595)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5628)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5629)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5704)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5726)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5707)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5926)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 41.160.125.197
Source: unknown	TCP traffic detected without corresponding DNS query: 166.51.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 176.38.26.119
Source: unknown	TCP traffic detected without corresponding DNS query: 91.226.205.110
Source: unknown	TCP traffic detected without corresponding DNS query: 24.67.20.244
Source: unknown	TCP traffic detected without corresponding DNS query: 82.204.104.30
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.44.70
Source: unknown	TCP traffic detected without corresponding DNS query: 200.245.132.145
Source: unknown	TCP traffic detected without corresponding DNS query: 131.190.90.59
Source: unknown	TCP traffic detected without corresponding DNS query: 194.63.94.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.76.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 168.95.135.173
Source: unknown	TCP traffic detected without corresponding DNS query: 14.91.14.55
Source: unknown	TCP traffic detected without corresponding DNS query: 46.251.156.175
Source: unknown	TCP traffic detected without corresponding DNS query: 148.105.124.203
Source: unknown	TCP traffic detected without corresponding DNS query: 24.226.8.2
Source: unknown	TCP traffic detected without corresponding DNS query: 27.72.93.212
Source: unknown	TCP traffic detected without corresponding DNS query: 159.249.31.184
Source: unknown	TCP traffic detected without corresponding DNS query: 12.198.161.241
Source: unknown	TCP traffic detected without corresponding DNS query: 24.253.132.217
Source: unknown	TCP traffic detected without corresponding DNS query: 14.1.46.98
Source: unknown	TCP traffic detected without corresponding DNS query: 87.85.131.141
Source: unknown	TCP traffic detected without corresponding DNS query: 1.19.56.159
Source: unknown	TCP traffic detected without corresponding DNS query: 139.150.178.175
Source: unknown	TCP traffic detected without corresponding DNS query: 48.111.87.74
Source: unknown	TCP traffic detected without corresponding DNS query: 46.98.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 94.205.126.69
Source: unknown	TCP traffic detected without corresponding DNS query: 5.3.61.186
Source: unknown	TCP traffic detected without corresponding DNS query: 128.212.162.24
Source: unknown	TCP traffic detected without corresponding DNS query: 117.49.101.63
Source: unknown	TCP traffic detected without corresponding DNS query: 168.249.184.238
Source: unknown	TCP traffic detected without corresponding DNS query: 174.121.153.78
Source: unknown	TCP traffic detected without corresponding DNS query: 17.17.117.139
Source: unknown	TCP traffic detected without corresponding DNS query: 2.203.60.196
Source: unknown	TCP traffic detected without corresponding DNS query: 168.108.121.217
Source: unknown	TCP traffic detected without corresponding DNS query: 77.121.25.12
Source: unknown	TCP traffic detected without corresponding DNS query: 36.165.215.189
Source: unknown	TCP traffic detected without corresponding DNS query: 126.149.97.170
Source: unknown	TCP traffic detected without corresponding DNS query: 191.174.168.59
Source: unknown	TCP traffic detected without corresponding DNS query: 171.8.124.203
Source: unknown	TCP traffic detected without corresponding DNS query: 71.33.54.169
Source: unknown	TCP traffic detected without corresponding DNS query: 125.56.45.90
Source: unknown	TCP traffic detected without corresponding DNS query: 220.22.245.153
Source: unknown	TCP traffic detected without corresponding DNS query: 153.135.165.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.29.238
Source: unknown	TCP traffic detected without corresponding DNS query: 216.49.171.199
Source: unknown	TCP traffic detected without corresponding DNS query: 72.192.181.130
Source: unknown	TCP traffic detected without corresponding DNS query: 77.58.176.124
Source: unknown	TCP traffic detected without corresponding DNS query: 147.219.185.254
Source: unknown	TCP traffic detected without corresponding DNS query: 174.39.200.127

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: Xorg.0.log.151.dr, syslog.26.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.151.dr, syslog.26.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.26.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3703, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3704, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3705, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3706, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3715, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 5415, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 5431, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3703, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3704, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3705, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3706, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3715, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 5434, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 5437, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5704)	SIGKILL sent: pid: 5720, result: successful
Source: /usr/bin/dbus-daemon (PID: 5704)	SIGKILL sent: pid: 5946, result: successful
Source: /usr/bin/dbus-daemon (PID: 5704)	SIGKILL sent: pid: 6120, result: successful
Source: /usr/bin/dbus-daemon (PID: 5726)	SIGKILL sent: pid: 5999, result: successful

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: 'byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3703, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3704, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3705, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3706, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 3715, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 5415, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	SIGKILL sent: pid: 5431, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3703, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3704, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3705, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3706, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 3715, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 5434, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5437)	SIGKILL sent: pid: 5437, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5704)	SIGKILL sent: pid: 5720, result: successful
Source: /usr/bin/dbus-daemon (PID: 5704)	SIGKILL sent: pid: 5946, result: successful
Source: /usr/bin/dbus-daemon (PID: 5704)	SIGKILL sent: pid: 6120, result: successful
Source: /usr/bin/dbus-daemon (PID: 5726)	SIGKILL sent: pid: 5999, result: successful

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/96@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5481)	File: /proc/5481/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5484)	File: /proc/5484/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5575)	File: /proc/5575/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5628)	File: /proc/5628/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5704)	File: /proc/5704/mounts
Source: /usr/bin/dbus-daemon (PID: 5726)	File: /proc/5726/mounts
Source: /usr/bin/gjs (PID: 6121)	File: /proc/6121/mounts
Source: /usr/bin/gnome-shell (PID: 5767)	File: /proc/5767/mounts
Source: /usr/bin/dbus-daemon (PID: 5625)	File: /proc/5625/mounts

Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat06IdSjW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127srH9JX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127dav0WV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0Xo91UT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127jZyuhW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1V8SHPW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127cRkriX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat003yFDV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127mKzAwW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c14WEsfY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1AddulX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127cnsaAU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1tpi29X	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1u9I7AW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1cmFh2X	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127vQROgW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat07IjKMX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127HLuJQT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0rBsjPV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127sFv3dY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0tHuFqV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127cK93OX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2hrKB2X	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127FDHVFT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0KpuuUX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2CsredW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2fNLWXU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127GP93pW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2SdHqTX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2UwvxsU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2a2eg7V	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2SbGjbW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c28Qt0bY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/inhibit/.#1ITVSTV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/inhibit/.#29ScS2W	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/inhibit/.#37BJ6IX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/inhibit/.#4gOVR4U	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5558)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5651)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5651)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5685)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5727)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5767)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5767)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5767)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5767)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5767)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5767)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5767)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 5943)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 5943)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6143)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6143)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6147)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6147)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6149)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6149)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6151)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6151)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6170)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6170)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 5956)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 5956)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6117)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6187)	Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6375)	Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6390)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6390)	Directory: <invalid fd (11)>/..

Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5481/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5481/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5482/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5482/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5482/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6375/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5683/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6157/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5685/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6114/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6390/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6170/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6151/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6151/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6150/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5555/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6623/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6149/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5678/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5678/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5558/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/2926/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6605/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5615/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5615/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5956/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6141/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5791/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6187/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5595/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6443/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5651/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6002/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6002/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5498/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6346/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5994/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5994/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5994/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6147/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5629/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5707/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6117/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6117/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6116/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5623/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5601/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5767/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/5379/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/5274/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5431)	File opened: /proc/6/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5568)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5570)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5573)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5576)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5578)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5580)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5582)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5584)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5696)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 5944)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5612)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5569)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5571)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5574)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5577)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5579)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5581)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5583)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5585)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5614)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5589)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5562)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5595)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5595)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5483)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5483)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5567)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5685)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 45302
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 45464
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 45564
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 45602

Source: /usr/bin/gpu-manager (PID: 5567)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685)	Truncated file: /var/log/Xorg.pid-5685.log

Source: /usr/bin/pulseaudio (PID: 5482)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5589)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5685)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5727)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5767)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5994)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/na.elf (PID: 5429)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5482)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5562)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5567)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5615)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5629)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5678)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5683)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5685)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5721)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6000)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5707)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5708)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5727)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5737)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5767)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 5943)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6143)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6147)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6149)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6153)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6157)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6170)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5994)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6116)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6117)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6187)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6605)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6623)	Queries kernel information via 'uname':

Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.013] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.321] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.624] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.025] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.666] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.502] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.567] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.493] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.192] (--) vmware(0): vram: 4194304
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.272] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.547] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.878] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:25 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.009] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.753] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: na.elf, 5429.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5431.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5432.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5434.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5437.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5438.1.00005574f0e63000.00005574f0eea000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.770] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.918] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.602] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.878] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.171] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.617] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.449] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:41 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.420] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.716] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.277] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.587] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.903] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.242] (==) vmware(0): Default visual is TrueColor
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:41 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.377] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.406] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.023] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.494] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.500] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.520] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.336] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: na.elf, 5429.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5431.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5432.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5434.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5437.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5438.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.536] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.827] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.039] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): w.blu: 8
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.949] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.590] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.361] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.641] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.779] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.258] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.459] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.200] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.482] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.770] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.455] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.626] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.434] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.031] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.853] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.682] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 154.474] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.708] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.399] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.860] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.598] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.713] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: na.elf, 5429.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5431.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5432.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5434.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5437.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp, na.elf, 5438.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.053] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.508] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.061] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.504] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.670] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.232] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.963] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): bpp: 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.934] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.732] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.111] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:25 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) LoadModule: "vmware"
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.620] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.678] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.885] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.445] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 169.416] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.537] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:26 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.452] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.650] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.472] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.590] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.473] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.719] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.654] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.877] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.081] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.365] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.393] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.108] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.809] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.284] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.150] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.713] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.291] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.918] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.486] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.706] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.441] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 162.022] (==) vmware(0): Backing store enabled
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.295] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.504] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.265] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.563] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.815] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.310] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.196] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.587] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.095] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.001] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.160] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.922] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.814] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.249] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.215] (--) vmware(0): w.red: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.916] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.481] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.609] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.865] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.741] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.474] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.528] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.447] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.361] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.163] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.109] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.432] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.412] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.757] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: na.elf, 5431.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp	Binary or memory string: tU/tmp/qemu-open.ZpUvOR
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.912] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.565] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.130] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.224] (--) vmware(0): w.blu: 8
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 169.772] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr	Binary or memory string: [ 169.989] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.728] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.818] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.540] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.613] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.331] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 153.577] (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:41 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.200] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.671] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.650] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.570] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): depth: 24
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.792] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.253] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.511] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.637] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.546] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.737] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.656] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.436] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.658] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.617] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.969] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.236] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.017] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.463] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.798] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.609] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.404] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.848] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.327] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.309] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.313] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.551] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.787] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.344] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.929] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.371] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.914] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.955] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.067] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 153.648] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: na.elf, 5437.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp	Binary or memory string: tU/tmp/qemu-open.szYMRj
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.174] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.349] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.512] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.498] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.238] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.348] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.321] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.375] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.187] (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.079] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 169.427] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 169.950] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.766] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.723] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.357] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.986] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 153.706] (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): DPI set to (96, 96)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.467] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.325] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.924] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.448] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.086] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.227] (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.749] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.605] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.628] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: na.elf, 5437.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.szYMRj
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.908] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.571] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.268] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:26 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.474] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.492] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.249] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.697] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.517] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.782] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.495] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 154.040] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.871] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.896] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.594] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.854] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.579] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.840] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.904] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.431] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.753] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.245] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.423] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.291] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.802] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.914] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.039] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.387] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.219] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.562] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.745] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.416] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.773] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.683] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.340] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.383] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.883] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.998] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.758] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.287] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.955] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.204] (--) vmware(0): mheig: 885
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.575] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.532] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.261] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.183] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.211] (--) vmware(0): bpp: 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.920] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.489] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.387] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:25 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.803] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.662] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.024] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: na.elf, 5429.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5431.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5432.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5434.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5437.1.00005574f0e63000.00005574f0eea000.rw-.sdmp, na.elf, 5438.1.00005574f0e63000.00005574f0eea000.rw-.sdmp	Binary or memory string: tU!/etc/qemu-binfmt/mipsel
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.491] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.559] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 161.070] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.179] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.695] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: na.elf, 5431.1.00007ffd587ef000.00007ffd58810000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.ZpUvOR
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:34 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.009] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.728] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.402] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.575] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 153.628] (II) LoadModule: "vmware"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.305] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 162.033] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.441] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.298] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.318] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.313] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.416] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 170.558] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.943] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.208] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.792] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.307] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 162.053] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.301] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 169.965] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.470] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.088] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.463] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.516] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.761] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.424] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.220] (--) vmware(0): w.grn: 8
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (WW) vmware(0): Disabling 3D support.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.890] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.644] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.602] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.959] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.826] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.246] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.512] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:31 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.429] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 169.957] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 157.924] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:30 galassia /usr/lib/gdm3/gdm-x-session[5685]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.632] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:33 galassia /usr/lib/gdm3/gdm-x-session[5685]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.704] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.524] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 160.977] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.975] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:32 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 159.069] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:22:42 galassia /usr/lib/gdm3/gdm-x-session[5685]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.353] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.257] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 158.700] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5601)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5434.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5429.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5429, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5434.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5429.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5429, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5434.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5429.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5429, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5434.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5429.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff654400000.00007ff654415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5429, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	67%	ReversingLabs	Linux.Backdoor.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.26.dr	false	unknown
http://wiki.x.org	Xorg.0.log.151.dr, syslog.26.dr	false	unknown
http://www.ubuntu.com/support)	Xorg.0.log.151.dr, syslog.26.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
209.144.94.224	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
87.184.38.219	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
65.176.213.40	unknown	United States	1239	SPRINTLINKUS	false
138.189.215.87	unknown	Switzerland	12511	CH-POSTNETZPostCHAGCH	false
82.70.92.76	unknown	United Kingdom	13037	ZEN-ASZenInternet-UKGB	false
59.239.123.33	unknown	China	2516	KDDIKDDICORPORATIONJP	false
171.132.210.234	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
165.197.197.232	unknown	United States	2152	CSUNET-NWUS	false
173.213.44.170	unknown	United States	53316	ASN-CHEETA-MAILUS	false
186.131.227.230	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
157.161.177.150	unknown	Switzerland	6772	IMPNET-ASCH	false
213.1.47.99	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
96.29.211.36	unknown	United States	10796	TWC-10796-MIDWESTUS	false
57.63.222.41	unknown	Belgium	2686	ATGS-MMD-ASUS	false
125.253.224.215	unknown	Hong Kong	38056	GLOBECOMM-HK-ASGlobecommNetworkServicesCorpTransitASI	false
92.224.168.13	unknown	Germany	6805	TDDE-ASN1DE	false
195.232.253.78	unknown	Germany	12663	VODAFONE-GROUPIT	false
101.160.47.3	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
164.84.153.244	unknown	United States	134984	NEXTGEN-AS-APNextGenNetPtyLtdAU	false
209.135.157.133	unknown	United States	6428	CDMUS	false
51.142.97.176	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
79.17.204.96	unknown	Italy	3269	ASN-IBSNAZIT	false
178.7.142.78	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
107.65.66.112	unknown	United States	7018	ATT-INTERNET4US	false
200.227.227.132	unknown	Brazil	4230	CLAROSABR	false
186.192.242.217	unknown	Brazil	53138	ConectlanInternetBR	false
222.156.110.236	unknown	Taiwan; Republic of China (ROC)	7482	APOL-ASAsiaPacificOn-lineServiceIncTW	false
182.249.115.27	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
163.76.244.91	unknown	France	14340	SALESFORCEUS	false
201.58.44.201	unknown	Brazil	7738	TelemarNorteLesteSABR	false
213.42.251.202	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
94.27.69.158	unknown	Ukraine	12530	GOLDENTELECOM-UKRAINEKyivstarPJSCUA	false
201.14.164.199	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
155.19.196.171	unknown	United States	1494	DNIC-ASBLK-01494-01495US	false
190.156.168.117	unknown	Colombia	10620	TelmexColombiaSACO	false
138.133.158.61	unknown	United States	3269	ASN-IBSNAZIT	false
38.79.86.229	unknown	United States	397525	ALPHAONE-ASUS	false
43.106.75.61	unknown	Japan	4249	LILLY-ASUS	false
202.212.22.138	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
136.159.124.44	unknown	Canada	33091	U-CALGARYCA	false
97.205.56.195	unknown	United States	6167	CELLCO-PARTUS	false
108.53.69.124	unknown	United States	701	UUNETUS	false
133.218.135.80	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
39.72.248.82	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
86.175.23.201	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
32.179.230.42	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
60.156.44.35	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
136.175.129.241	unknown	Reserved	22498	PINELLAS-COUNTYUS	false
174.183.54.72	unknown	United States	7922	COMCAST-7922US	false
217.101.79.67	unknown	Netherlands	33915	TNF-ASNL	false
172.250.116.226	unknown	United States	20001	TWC-20001-PACWESTUS	false
17.232.208.214	unknown	United States	714	APPLE-ENGINEERINGUS	false
90.79.30.143	unknown	France	3215	FranceTelecom-OrangeFR	false
135.76.111.176	unknown	United States	18676	AVAYAUS	false
155.51.135.230	unknown	United States	5647	ASN-KODAKUS	false
65.163.214.143	unknown	United States	1239	SPRINTLINKUS	false
17.110.130.68	unknown	United States	714	APPLE-ENGINEERINGUS	false
124.83.132.226	unknown	Japan	24572	YAHOO-JP-AS-APYahooJapanJP	false
116.109.198.10	unknown	Viet Nam	24086	VIETTEL-AS-VNViettelCorporationVN	false
209.5.184.7	unknown	Canada	3602	AS3602-ROGERS-COMCA	false
75.122.160.50	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
84.61.19.207	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
86.209.52.168	unknown	France	3215	FranceTelecom-OrangeFR	false
137.252.83.122	unknown	United States	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
208.144.203.107	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
75.74.178.246	unknown	United States	7922	COMCAST-7922US	false
25.61.6.21	unknown	United Kingdom	7922	COMCAST-7922US	false
37.94.133.140	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
100.131.224.68	unknown	United States	21928	T-MOBILE-AS21928US	false
168.235.88.18	unknown	United States	3842	RAMNODEUS	false
79.167.165.54	unknown	Greece	3329	HOL-GRAthensGreeceGR	false
187.164.89.41	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
111.132.36.131	unknown	China	24138	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
41.210.115.191	unknown	unknown	29614	GHANATEL-ASGH	false
182.174.45.60	unknown	China	23724	CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation	false
38.151.122.157	unknown	United States	174	COGENT-174US	false
17.59.155.191	unknown	United States	714	APPLE-ENGINEERINGUS	false
144.9.162.163	unknown	United States	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
95.126.182.158	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
36.37.168.155	unknown	Cambodia	38623	VIETTELCAMBODIA-AS-APISPIXPINCAMBODIAWITHTHEBESTVERV	false
107.169.197.220	unknown	Reserved	40676	AS40676US	false
187.210.223.133	unknown	Mexico	8151	UninetSAdeCVMX	false
17.70.140.215	unknown	United States	714	APPLE-ENGINEERINGUS	false
47.255.177.103	unknown	Canada	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
4.191.205.37	unknown	United States	3356	LEVEL3US	false
108.176.28.17	unknown	United States	12271	TWC-12271-NYCUS	false
97.38.132.51	unknown	United States	6167	CELLCO-PARTUS	false
205.53.193.253	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
109.36.132.112	unknown	Netherlands	15480	VFNL-ASVodafoneNLAutonomousSystemNL	false
87.203.99.179	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
57.74.23.11	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
68.45.1.190	unknown	United States	7922	COMCAST-7922US	false
185.33.22.61	unknown	Switzerland	60311	ONEFMCH	false
169.13.99.33	unknown	United States	203	CENTURYLINK-LEGACY-LVLT-203US	false
80.128.29.8	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
174.200.107.217	unknown	United States	22394	CELLCOUS	false
70.214.137.45	unknown	United States	6167	CELLCO-PARTUS	false
113.58.178.63	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
139.90.44.15	unknown	Belgium	270	AS270US	false
134.143.28.122	unknown	Netherlands	32432	COFANUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
65.176.213.40	LmRWdFDFaQ.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	COqla3YyQo.elf	Get hash	malicious	Mirai	Browse
	aqua.mpsl	Get hash	malicious	Gafgyt, Mirai	Browse
	H8aSSMrsHO	Get hash	malicious	Mirai	Browse
82.70.92.76	88yANCU0Ae.elf	Get hash	malicious	Mirai	Browse
59.239.123.33	nj6dUhYsz3	Get hash	malicious	Mirai	Browse
59.239.123.33	x86	Get hash	malicious	Mirai	Browse
186.131.227.230	jU5izFGdQb	Get hash	malicious	Mirai	Browse
157.161.177.150	mips.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse
	z4mEUr6KOL.elf	Get hash	malicious	Mirai, Moobot	Browse
213.1.47.99	3CZk5xMzFd	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CENTURYLINK-LEGACY-SAVVISUS	na.elf	Get hash	malicious	Mirai	Browse	208.156.37.155
	na.elf	Get hash	malicious	Mirai	Browse	207.48.156.72
	z3hir.arm7.elf	Get hash	malicious	Mirai	Browse	64.243.102.110
	arm-20241006-0950.elf	Get hash	malicious	Mirai	Browse	208.141.122.167
	yakov.arm.elf	Get hash	malicious	Mirai	Browse	208.169.99.54
	yakov.mpsl.elf	Get hash	malicious	Mirai	Browse	209.27.25.101
	yakov.ppc.elf	Get hash	malicious	Mirai	Browse	208.149.200.185
	yakov.x86.elf	Get hash	malicious	Mirai	Browse	206.132.149.146
	7fi7NmSbkN.elf	Get hash	malicious	Mirai	Browse	208.165.164.91
	SecuriteInfo.com.Linux.Siggen.9999.31454.15725.elf	Get hash	malicious	Unknown	Browse	209.1.15.212
SPRINTLINKUS	na.elf	Get hash	malicious	Mirai	Browse	208.35.138.200
	na.elf	Get hash	malicious	Mirai	Browse	63.166.110.231
	na.elf	Get hash	malicious	Mirai	Browse	160.81.164.85
	MOfHb44mph.elf	Get hash	malicious	Unknown	Browse	63.174.132.105
	novo.arm64.elf	Get hash	malicious	Mirai, Moobot	Browse	173.148.154.200
	novo.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	144.239.179.228
	novo.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	204.125.133.188
	yakov.spc.elf	Get hash	malicious	Mirai	Browse	173.97.209.98
	SecuriteInfo.com.Linux.Siggen.9999.28522.3483.elf	Get hash	malicious	Mirai	Browse	205.191.249.110
	7fi7NmSbkN.elf	Get hash	malicious	Mirai	Browse	173.104.159.8
CH-POSTNETZPostCHAGCH	jydeTkHxMv.elf	Get hash	malicious	Unknown	Browse	194.41.152.32
	3B4ehVz4C4.elf	Get hash	malicious	Mirai	Browse	138.189.215.82
	arm7.elf	Get hash	malicious	Mirai	Browse	138.191.5.11
	https://frdgf4.com/8766217034	Get hash	malicious	Unknown	Browse	194.41.166.21
	arm7.elf	Get hash	malicious	Mirai	Browse	138.191.5.18
	GcOeQTPzrh.elf	Get hash	malicious	Unknown	Browse	138.189.240.83
	hCGaMRj2il.elf	Get hash	malicious	Mirai	Browse	138.189.240.84
	YrwQEQwAlQ.elf	Get hash	malicious	Mirai	Browse	138.189.215.74
	Nc2zs66ZvW.elf	Get hash	malicious	Unknown	Browse	138.191.50.241
	Z4s9xPQyPM.elf	Get hash	malicious	Unknown	Browse	138.191.50.240
DTAGInternetserviceprovideroperationsDE	na.elf	Get hash	malicious	Mirai	Browse	91.18.134.23
	na.elf	Get hash	malicious	Mirai	Browse	217.92.131.56
	na.elf	Get hash	malicious	Mirai	Browse	91.45.253.225
	na.elf	Get hash	malicious	Mirai	Browse	93.217.230.69
	na.elf	Get hash	malicious	Mirai	Browse	217.238.216.72
	na.elf	Get hash	malicious	Mirai	Browse	79.242.243.194
	na.elf	Get hash	malicious	Mirai	Browse	93.217.81.225
	na.elf	Get hash	malicious	Mirai	Browse	31.247.60.236
	na.elf	Get hash	malicious	Mirai	Browse	31.234.6.20
	na.elf	Get hash	malicious	Mirai	Browse	31.228.35.242

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5633/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5636/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5638/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5640/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5642/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5644/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5647/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5721/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5751/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5754/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5756/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5758/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5760/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5762/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5765/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5947/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6000/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6121/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6335/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:5jn:9n
MD5:	163481A6C5824B15680C3190A8751782
SHA1:	572B436194018308D3737E95B2244048F13E33C9
SHA-256:	0975E0D37D3CD2AE6AC1E35F85E90C7611AEC702D706CB9BBB9E371935D0176D
SHA-512:	42A85A466CC49A4A7D81E49C768E58F4BD398B7B775586F98A33E16BE3B774CFCD782BF416D760426213EBEFE4B1A1615D389A732F4B97B27FA5D9FACBC11352
Malicious:	false
Preview:	6116.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.3709505944546687
Encrypted:	false
SSDEEP:	3:Fc6:v
MD5:	214114D04C3E283BC8EFEEF080BA169B
SHA1:	A8192FE7221483142D38F63CBA0AF0B3D8596510
SHA-256:	0FFF84863B39E3D023BB7B3049036295507FE2CBAA3B1A98ED55499E1E1887F3
SHA-512:	84651853F64B7A69A9614B77AF99B1F90768282B0A5C30839237FD46D19987A5EADB0D8027721E817063147D68C317CF9F77BF32D7EF739F06245E508F806F78
Malicious:	false
Preview:	5595.

/run/systemd/inhibit/.#1ITVSTV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifMW0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApf8ApLHK7wR9n
MD5:	F08C08724EEF499938931EA14DC4D629
SHA1:	47AF165769DF3E5B478EC1295439731889977EB7
SHA-256:	2E2458C487BB79E9D17309B6AB62722C60C24D66706DD9907869743B73632C42
SHA-512:	49E0FA249DAEF56B79DE2DB6CA51B124BDB8538C5D91DB1F98E07C1FF6EAB09AE2E2491B4D2AF0DDE9955DF3BD89AFA7637C35D66799FB378A923E3CF288DF66
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5956.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#29ScS2W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.209300645304899
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+rLqKLXv0Rsz:qgFqXQXTI1IlWqKjcRsz
MD5:	B920C521D95E1123428CBE3E725398FB
SHA1:	587DFED79B200FECD5726B227929F577F464B65E
SHA-256:	E74DEA0625A5629A2C9B32D9BD6696F71CCBF9E2CC0DAF6707B4B83FCD924C1C
SHA-512:	B9E92759E9C2DC64EB9EB0CCA1B94EB2BBC0D7AA120412DB8D5005E61DC600EBE4517A7F06076B21312A394238B20E6E1189037B676A780197EE96A5AAE2976C
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6157.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#37BJ6IX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++cvR3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+rLqKLXv0RT
MD5:	159EADBD1B7779CC965A0447F1AA1DF9
SHA1:	D5F72DF58BBD3678905706F06273520126B66C9E
SHA-256:	A7075C080962D5489B747DE1341CB285BBA29AB5D2DC6508ACAA1800B8AB88F2
SHA-512:	45202597850B6771A3F92E0602FAF950B9CCE2A61536C57D225D12B45E2C5D885590108747A021137BC8B294E5D47A81085CE0A0DA32B2E8267E7253469DA1EF
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6157.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4gOVR4U

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.152041866447974
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++hqiiXulpv5RX8/SflY:SbFuFyL8OAAx+CFlpLRS
MD5:	05AA91EA158F4A34011DA726257D4F44
SHA1:	0201DEF224C64684D22BAFB1CBBDBF05079E8567
SHA-256:	0045F14735251091D2C7E664001FA99FEB5B67E98DDE09E8355CBACFD35BECAF
SHA-512:	25F0CC497A9235A05108D2144CF751B9884DC67D3FEC01B447FD5621734A0D1B43EF00C4AF9C3DEBBAD484200C2FA1A61FBDD7E586AA61217DAEED9996824AFC
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6170.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/seats/.#seat003yFDV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat06IdSjW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat07IjKMX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0KpuuUX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0Xo91UT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0rBsjPV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0tHuFqV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/sessions/.#c14WEsfY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.431090283479819
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK7JgTmeJn:qgFqPuFN6IG0n99x2xayWK7JgyeJn
MD5:	69F5371EA1D820013B83E162A8AFBBD8
SHA1:	2601D1A4F9C5E3920CDE1554D0A1D59265FD79CB
SHA-256:	759D17E8833A50B2A36A332DE18076444B1F594E06FC021BCF1A20738EE57BB0
SHA-512:	EC522444CE41521BD515577F96598D681E7F963F9E2C8862AF9E7F00D6986096F400F05619DD907BC9076A409E30EF9628C001D55044AAF69C5B474F9D93FC23
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246131207810.MONOTONIC=138904695.

/run/systemd/sessions/.#c1AddulX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.431090283479819
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK7JgTmeJn:qgFqPuFN6IG0n99x2xayWK7JgyeJn
MD5:	69F5371EA1D820013B83E162A8AFBBD8
SHA1:	2601D1A4F9C5E3920CDE1554D0A1D59265FD79CB
SHA-256:	759D17E8833A50B2A36A332DE18076444B1F594E06FC021BCF1A20738EE57BB0
SHA-512:	EC522444CE41521BD515577F96598D681E7F963F9E2C8862AF9E7F00D6986096F400F05619DD907BC9076A409E30EF9628C001D55044AAF69C5B474F9D93FC23
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246131207810.MONOTONIC=138904695.

/run/systemd/sessions/.#c1V8SHPW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.4840613084774485
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffC5hBxfx2xNIByy6GBK7JgTmeJn:qgFqPuFVuRZI4BKB9x2xayWK7JgyeJn
MD5:	1EEC4AC29224B70CA4CB4D36B926739E
SHA1:	8791D996F90B2881994033878E9662D0F40297FB
SHA-256:	4E473EF40058732D42C4A3281577DD34644B58CB1359AF6167000FC17F8E7A4C
SHA-512:	54BAC321C5849DC7E4E59E57D8CB7E27A62744640B93E3B1AA6FB469574DD6B8C88EC9E67525947775DD3CBC1F53C70E795C4588B81CCB07B294F1578D3E7299
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7810.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246131207810.MONOTONIC=138904695.

/run/systemd/sessions/.#c1cmFh2X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.3897106196995415
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBK7JgTmeJn:qgFqPuFdDJIi9x2xayWK7JgyeJn
MD5:	B2AB1FAF3750430C163A36189CD20B90
SHA1:	E887BD8AE6DA8E3A15F3D1AC36E2CF891AD726F4
SHA-256:	E04B0B7069EDEF3E10BC64C7F2E083A4E3CB6492D5E1278A5FF8F3BB6C620D3F
SHA-512:	54EBE32B2D34F2EFC9F82072A2FD3A07E4F965C9265DF4F6C7C744313A9C60313DB84670DF7E665F50C52CBE745044B7BC98A6B604DD5B30D7EDEE43666D17D0
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246131207810.MONOTONIC=138904695.

/run/systemd/sessions/.#c1tpi29X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.439338714679161
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK7JgTmeJJ:qgFqPuFN6IG0n99x2xayWK7JgyeJJ
MD5:	8E7EA26FD7B15F7E169E03A86C64A003
SHA1:	BFD11A1130B9D2A39B1F72038B198482E02E37D0
SHA-256:	CD19C9C8AF99BF867FB869C80DEAE45ED22D6A1069122AD472F6FF3D59375BC4
SHA-512:	E8C96F500A50F9FE8CDACDDB07E074AA88DEDF4186FC02E82CD066D87268928FC2D905C30E87849D22C855AD52CA8220E2702A583D04DD3C04E08CD17D3C71F1
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246131207810.MONOTONIC=138904695.CONTROLLER=:1.15.

/run/systemd/sessions/.#c1u9I7AW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.431090283479819
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK7JgTmeJn:qgFqPuFN6IG0n99x2xayWK7JgyeJn
MD5:	69F5371EA1D820013B83E162A8AFBBD8
SHA1:	2601D1A4F9C5E3920CDE1554D0A1D59265FD79CB
SHA-256:	759D17E8833A50B2A36A332DE18076444B1F594E06FC021BCF1A20738EE57BB0
SHA-512:	EC522444CE41521BD515577F96598D681E7F963F9E2C8862AF9E7F00D6986096F400F05619DD907BC9076A409E30EF9628C001D55044AAF69C5B474F9D93FC23
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246131207810.MONOTONIC=138904695.

/run/systemd/sessions/.#c28Qt0bY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.45936620147024
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugTRLbfE+QxMG:qgFqPuFNuCH0nI9x2xayWKugdLbfE8G
MD5:	A7575F11A8A20D0D81B8295349D35F20
SHA1:	CF4F7B6D0C73EE4B5305BD9B07CEBACFC572B556
SHA-256:	1E8021DAC8B50E3D82D90B2ED527B8A7004FAE51D62E9DF4A05BB7295919445B
SHA-512:	3F34EA31E414B7C3FBE0BDF484C38D218153A14B8E64502021B3C0831536F4F986DDF587FAE40B0F95649630347C3B8F54855A2FC84FE18F7E26803C8D1276BF
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246141763578.MONOTONIC=149460463.CONTROLLER=:1.19.DEVICES=13:65 13:66 13:64 13:67 .

/run/systemd/sessions/.#c2CsredW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.429607395063882
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugTRLbfEv:qgFqPuFNuCH0nI9x2xayWKugdLbfEv
MD5:	DE4ACACABCCE9F457541BAD492887205
SHA1:	C608A11944517F1971B47207D53F6A46F48B0827
SHA-256:	C126DDBDB1E3A87727CAABFE9B1F4BCA7511B2EFDBAF667DA800AF0DFBEBC446
SHA-512:	5E6E3B35D1D7284DA4E6919521000528987AADE76A25AA0931D0D3613A2B399FE413396BAB847153999758897E725260AD7CF024A681537AC601D303A607BE04
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246141763578.MONOTONIC=149460463.

/run/systemd/sessions/.#c2SbGjbW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.459653592695238
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugTRLbfE+QxMc:qgFqPuFNuCH0nI9x2xayWKugdLbfE8c
MD5:	D5F82D4584A4C7E9C95DC278940202E5
SHA1:	191A47EF916C31C66D964493FF0A6BCAA7AC290B
SHA-256:	414EEC4BB47ADA871E8690A4C8BE1F28F2095D0C8A3B94849CBB60BBE34836C5
SHA-512:	2E1DEBAAF790F034287ECB4DB1790A91F48A1BC55FB3F6DF792CC79A92AB569998474DFB4E72C6803089288068015946C769A8C1BEAF7A1D5444362AC2C897B6
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246141763578.MONOTONIC=149460463.CONTROLLER=:1.19.DEVICES=13:65 13:64 13:67 .

/run/systemd/sessions/.#c2SdHqTX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.442195246706924
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugTRLbfE+Qx1:qgFqPuFNuCH0nI9x2xayWKugdLbfEl
MD5:	40349BFCABB2F7C1B79FB3056826E585
SHA1:	BE72BE38E917873058A1274D2F65E38B89CE6FFD
SHA-256:	3A5FCE50AAA3E243B20CAFFAF063F1FBBE4BE9344420D70798D67627E36945B8
SHA-512:	7A978B12CE825C5B9E10724C7C8AFAA198C091B62C023BD31274C5AF7D8D00B34EF6A3769A2269D81A9136804DC00B6FE53E985224B6836CE518707E454038A2
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246141763578.MONOTONIC=149460463.CONTROLLER=:1.19.

/run/systemd/sessions/.#c2UwvxsU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.443781204137389
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugTRLbfE+Qx3:qgFqPuFNuCH0nI9x2xayWKugdLbfEH
MD5:	1B7495414BC083300BAACB7F27640F98
SHA1:	56D91CE3A4CC1848546750E6938BBC497A533407
SHA-256:	C6AED0D3289D13230C8A84ACED3D0B8CB1AE6676CFD9339199EE78289DAAB073
SHA-512:	C1721E8C705107604346F94F8516D162BAD415F066C93F591DD5A787E50FAE10DBC7DB0D8395A5036BB429E64B141626CF60220D3DF299120C8DC086F1BCF78C
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246141763578.MONOTONIC=149460463.CONTROLLER=:1.19.DEVICES=13:64 .

/run/systemd/sessions/.#c2a2eg7V

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.455115446240606
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugTRLbfE+QxM3:qgFqPuFNuCH0nI9x2xayWKugdLbfE83
MD5:	E5F17DC0DB866B6F0FE8EEF842699850
SHA1:	7E3EA6F1239617C5ECF7A2A827F4DC8C3912CAA9
SHA-256:	AF6C3BB7A7EB706D7853D315A4E9B25046AD3E973A50D91E36E84C6BD38BE203
SHA-512:	5333D4496447EDE9E22A87938204EDD5721965EA02A6C42DDDEB769D41BA6C2C77612994AECF6E1C125FA0F7B823CE14C91F8FC3FAE35676577FFD91AB847CCC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246141763578.MONOTONIC=149460463.CONTROLLER=:1.19.DEVICES=13:65 13:64 .

/run/systemd/sessions/.#c2fNLWXU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.429607395063882
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugTRLbfEv:qgFqPuFNuCH0nI9x2xayWKugdLbfEv
MD5:	DE4ACACABCCE9F457541BAD492887205
SHA1:	C608A11944517F1971B47207D53F6A46F48B0827
SHA-256:	C126DDBDB1E3A87727CAABFE9B1F4BCA7511B2EFDBAF667DA800AF0DFBEBC446
SHA-512:	5E6E3B35D1D7284DA4E6919521000528987AADE76A25AA0931D0D3613A2B399FE413396BAB847153999758897E725260AD7CF024A681537AC601D303A607BE04
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246141763578.MONOTONIC=149460463.

/run/systemd/sessions/.#c2hrKB2X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.483050264899603
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffC8gkBxfx2xNIByy6GBKugTRLbfEv:qgFqPuFVuRpCvB689x2xayWKugdLbfEv
MD5:	EEACC8A3F4B8E31D023E413A25988FD8
SHA1:	6DB2782B8E3334362329039FE53A964B476AA55D
SHA-256:	DAA96109D52F0DE4151170EF234CD08212E852B527F9CB9BB2947F17F6EA7C12
SHA-512:	A7241A5EC3ED163E565A0DFFF7C94784F8454DC2AE607D5DFF5A137E7373DCE39C75688BB039E97E5D1AD964B98DEFE5871B9F6AE92AA726683F11019746FA39
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7873.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246141763578.MONOTONIC=149460463.

/run/systemd/users/.#127FDHVFT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.185114915099895
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgTYcR6Ju0Y2z5c2zw02zb2owB:qgFq30z1cL/ixxTg8c8cqz5HzwPzbA
MD5:	0BBCFB9C14BAC5FDABC5E8C9E3BC3172
SHA1:	5C9F7A5A4376EFED284921A31685FCB2505AF8A2
SHA-256:	53D28CE066037BFF7C1D74E338332F7F41400507889F186AE17B7514EAE63F7F
SHA-512:	9DAFE256782310405FB7E51DDA3BCFEE5A1C522D6D1AAF412184ACD4A08462E593B210D4FC431589A81648B74188541BDB95DB3D859F1480F6E6F72D3C0BAECA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127GP93pW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.169178660119814
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgTYcR6Ju0Y2z5c2zw02zb2owB:qgFq30NzL/ixxTg8c8cqz5HzwPzbA
MD5:	00BAB8B14FFA84870F1DB8CD300CCCD3
SHA1:	CB4158D67D238862DC3B78C1DFECFDDE7615B9FC
SHA-256:	9B006286F71814E6A83C5579F7E1DA500355758B82D1A43C19A875945E110228
SHA-512:	F14B1CBAD44FAFBE4EFCE49BB2F1433430C18E0D08A9F6837ADDAED658EF9077FE8B1383B8E31070B13C802BFC4767A8D3556E96E790324B346A7C3782F4C027
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127HLuJQT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.16400726935129
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgTYcR6Ju0Y2thQc2pb02nmD2p9rwC:qgFq30dAL/ixeg8c8cqthQHtPnmDq9x
MD5:	FB130FDB7B4502C2257D9D32B850596A
SHA1:	FAFA632664B4D64E99A4A8A7E3197F786C4DE312
SHA-256:	3C955E6A8259FCA101F1338A5E319E27BC7836FA075DEB56047646157EBB8E3A
SHA-512:	D7CE95AF17054CD76E3160A72CFB449D1F2C67B713E454DE8B5AC4F80E7B7214767705689CDEC50B4D1F86C88AD72C84FDF8ECD1F6EC37180C1F3DF52234EAA9
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127cK93OX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.163440110999048
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgTYcR6Ju0Y2z5c2zw02zb2owB:qgFq30z1cL/iRJg8c8cqz5HzwPzbA
MD5:	8F59A6F52D849320B22AFEF292C0F9AC
SHA1:	98D169E64F43E0C9794EC8359B343FA8DCDDFEC0
SHA-256:	70502B09684AE5DBE8DC7DD1F4445F45E6A717BEDCD003CE59308A11312A852D
SHA-512:	9C71039B4261A56CC1C9DE3D2DA1A0BD1C3D4D9F6EE69E3317F86526FEA767526BF823DCEBCDB7E717CCF050AEC196C5E1BA297F272312A4FE8C103747674199
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127cRkriX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.325863328271921
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBvYfgTYcR6Ju0Y2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBFIg8c8cqthQHxbPYA
MD5:	42A1496397FB00EA1878FDF26194EC01
SHA1:	A1DE6DA6C98F46DD481B6AFBBEE6F774F5DEB47D
SHA-256:	42BED3564380BA6F7D19B4DE2FC53463C98977ABE8A286D734D47680A1D71E71
SHA-512:	C91AA8129A742269BED332D0D1C4E5BCD42CABAB2BD9DFBCB807EF2DAA8250B8D171716426418BD1B798653D34D6B769DF50CE43D32C80228D49D9390B1BD339
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.DISPLAY=c1.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127cnsaAU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.157971851385524
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgTYcR6Ju0Y2thQc2x9sS02/g2owB:qgFq30NzL/ixeg8c8cqthQHxbPYA
MD5:	5D278CBD6AC42139BE8E4275619DCB95
SHA1:	A98A8FA0336A14B195D9D20C778CECB370345F7E
SHA-256:	24AAC48812A9BFA8D36CC13F2D702FCF857F2A3C6F28D46C69A16F1D8404D65D
SHA-512:	DF3995DEF17B78D8FA2B609DF4783A738EC9755B7AD27A7977871B5517B8B4077774F058923C2C2D7BF3ECD3154364A834B543B7290DDB088D2DA0961B89BC5E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127dav0WV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.303776175353884
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBzgTYcR6Ju0Y2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBFg8c8cqthQHtPYq9M
MD5:	C9B73FEBF528243CF4714FB238D9115E
SHA1:	1C04AB18C1FF537EC95B48F970C741CCAFDF790C
SHA-256:	83198EEB57C42537301220B04EE41C12241858DCD7876B8F814AD9FEDD3AF107
SHA-512:	D60F7F1C6E5118F8A4F43373BA0BFA6F5BE11A1A3CC4B6E2E5F23BC92EA347CD6B03CDA53BAA27B99B993551355C679D82FC689621BCB63300A20AB02EDE1716
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127jZyuhW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.307140895859554
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBzgTYcR6Ju0Y2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBFg8c8cqthQHxbPYA
MD5:	6A0EA9FDE7D7AF2672343ACCBC92BE17
SHA1:	F720C6515B37563CCCBBC285E45CB85A38F2A0BF
SHA-256:	E4348A8D90426DDDCEB210150FFB354633422662F32E4199B62331DF3FD4796F
SHA-512:	3F98D22691A34365005D855800813794DBA0D85FA51C0A9F017AF4DD2E38D36C22835074F7D61D5FADFFC7BFB3D6B58FFE4815FBC3BDA087FCCB80B2DCC47618
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127mKzAwW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.173908106365604
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgTYcR6Ju0Y2thQc2x9sS02/g2owB:qgFq30z1cL/ixeg8c8cqthQHxbPYA
MD5:	7FBD1686C789A7559AFFA2ACDCC05610
SHA1:	FA156EA9EB1814604EC61F6CCBBDCB7817CF5EFC
SHA-256:	6957C51571B228E078BFAA38DDDC10A483BF9B5A16613947365E2473F7F0BC98
SHA-512:	CDE10FC37EC267EAECAD4D68113397AC1A2C7564C05FD08C0CE310E09768A9979574F3DB314889A1F82FF4562B9C707DBC140E22A1B82065E10D67060CA9CE66
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sFv3dY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.16400726935129
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgTYcR6Ju0Y2thQc2pb02nmD2p9rwC:qgFq30dAL/ixeg8c8cqthQHtPnmDq9x
MD5:	FB130FDB7B4502C2257D9D32B850596A
SHA1:	FAFA632664B4D64E99A4A8A7E3197F786C4DE312
SHA-256:	3C955E6A8259FCA101F1338A5E319E27BC7836FA075DEB56047646157EBB8E3A
SHA-512:	D7CE95AF17054CD76E3160A72CFB449D1F2C67B713E454DE8B5AC4F80E7B7214767705689CDEC50B4D1F86C88AD72C84FDF8ECD1F6EC37180C1F3DF52234EAA9
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127srH9JX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127vQROgW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.176582541046743
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgTYcR6Ju0Y2thQc2x9sS02nmD2owC:qgFq30dAL/ixeg8c8cqthQHxbPnmDd
MD5:	F5CBF1C1D4412028830255E42D76B0A3
SHA1:	EB5559840FDAD92A23F4BECFAC7F0AAB3612A665
SHA-256:	2BB120DE3DDF2B0B02D223E21ABA9E8E98F0605EEE0C8084ECDC3BA603800660
SHA-512:	C64510E61D6E701579B96168CD217C1CBCD842B30CC908B386D3818C1F771DA2B095542FDCF85A9AAEAB6E6327FA917D2F31352719D1E522E907BB51C92AD45C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246131194054.MONOTONIC=138890939.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:EVvn:EVv
MD5:	D53327372F4775498E57AD4D5DE24E03
SHA1:	45176CDCB6F5D11DA3420D4A5599E3B3DE94AF98
SHA-256:	54531E5A68E6E2219073678F6A03FF709F2D5976C148F9FA3885D653242FCCAE
SHA-512:	B7D3C03068A8361C103D76935BE6F1764F7B84C2623398570658A9B403025538EA8CEBC767129C0573D2B77011B0E877E6AF7082E198C21CBE776DDEB813C0CF
Malicious:	false
Preview:	5482.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.017182708842993
Encrypted:	false
SSDEEP:	12:OxPPCTJzOveY+PDCWxPeGgbeveY+e2VSxPH+rl9NOveY+H+5AxPu3o3ulveY+u3a:/TJEEA7WyetbFZA1/f
MD5:	66460AA45C6A8805F2B8808ED443683B
SHA1:	429869589BFB84A9C729ED54CA3C31564ECDC106
SHA-256:	789E3A436B0BA96E6767EB3BC9D73177A2C0BAB5F19D09949DCA7634FEE47DEA
SHA-512:	E0BF0E51FBF21E43DFDC6C2D77F0FA9278A1751A3771704FDE23E1CFB5CEC9E464E221330F803EC8789849BD9BD08437A78C108879BA607D7F4CC7BE22D4122F
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5707..MIT-MAGIC-COOKIE-1..a.7..:.$..2.-..G..XSMP...#local/galassia:@/tmp/.ICE-unix/5707..MIT-MAGIC-COOKIE-1..=. .......\|:.....ICE...!unix/galassia:/tmp/.ICE-unix/5629..MIT-MAGIC-COOKIE-1...s..e.3.S.@X......ICE...#local/galassia:@/tmp/.ICE-unix/5629..MIT-MAGIC-COOKIE-1..2.UM.3...T3...xz..XSMP...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....3.16G.\|.Q.......XSMP...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..uoT..;.......%....ICE...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...)....I...b....L..ICE...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1..j...w~q]$M....<...XSMP...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...i...........LE..XSMP...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...e.....-..3$....ICE...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....<..;..6<L.......ICE...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..ad.U~.OxR.c.}..(..XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.968777719849575
Encrypted:	false
SSDEEP:	3:rg/WFllasO93uxJKe7itWFllasO93uxJKes:rg/WFl2YDitWFl2YU
MD5:	1020CF541351FD3BAC31925DF6C9F2FF
SHA1:	84DBD92FB1888A8E9DB8539B5854B50B618FC55D
SHA-256:	82784B16BC7678BB6BF7292671852AB3C46EAE1F4A31E008700DFD72D6C3CFD2
SHA-512:	4267FFBCB74BAF527676FC7AE0B850276F7958110794D10E5F0C4B866004EA030D4111F22E1A1DC0052E3FC558B5412A0388E39E73147216C62E7C34AFA0CB29
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1....+..s..o..U.......galassia....MIT-MAGIC-COOKIE-1....+..s..o..U...

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:JcJn:Mn
MD5:	C49040BADB58448029F5BA3D174711F5
SHA1:	5BC243076366B8F97EF490F791F3CA2E3B6C3416
SHA-256:	B7A600279AD90EA9DF701DFFF5BC075B872F399B1848784864C18D04E93F76DA
SHA-512:	CB1D7387D52CA2C7F9F41D8AE0B6002C5FE42804F78E8AC6FAC43A85A45552B87AEBFCABA81ADEFA5514812B90CE7C2F884BFB99767AC961FD3CC0FCED71072A
Malicious:	false
Preview:	5994.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:6lSsXlXEWtl/0G///:6h+ylh
MD5:	26FD38A4128BE2BC152BDBBAEEE6CB52
SHA1:	E28B168C30991B8F50CE9F0C8325159508DF0ED9
SHA-256:	2A5DE102CBBAAA8BA820AF073EDE497C20A56C2D70B7D38FE8C92E80D740CFD2
SHA-512:	5984D20210DEAAB18353C82D99DEBD9B2E9D4E420728194FEFB6F90005921726BE17690C531F261B1AAB72465D0D347A16BE82CEEA242BD22B0C219201F7D9D3
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN..................................................................................................................................................................................................................................................................................................._..g&.......................................

/tmp/qemu-open.ZpUvOR (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/qemu-open.szYMRj (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.1GEBV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.KNTCV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.139556741935629
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWhWKARp19d:q5sU3LWfLUDmQymqSFbfomSn+pfd
MD5:	B9FDD3C9C3224E10B7F4CBFA081ADB91
SHA1:	52276B38111A3B011908E7A8BE1953AC26B285E6
SHA-256:	8FCE4C3ECE7CC95EA3B490CBFBBC34104B9C7B1C81AA30044F4A9F6BF4F37799
SHA-512:	D30EAA5510E52F6DF2B7EB43E6AAC5FFE9A3E22152716B80C5F03AFA35B481265C8F7A96A07769B0F192D49C3A08D5C00648C9C608F9FAE842AF9B9D9435E72E
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-9WEj9Nxj,guid=9eb69fcc5c352fc99c9b3d376702f1b0.IBUS_DAEMON_PID=5926.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.285076060586251
Encrypted:	false
SSDEEP:	384:QG1P0tlXJMldedJdydRd/dqdJdddydbdTLdBdPBd5d1dxdHdadpd7dj+daPdfQdy:h1P2CvZ7b8jEbEuAZhNhW2zRsA
MD5:	F3D342CFF58834D9555C7FD064BF9E04
SHA1:	166B395F2B1780C519545D8D2C0FDF1E34431B55
SHA-256:	DC4B74E1C9537775D4B95A2E4BCF59DF13DFE3D2E198854E70DF0ED06B2D4411
SHA-512:	973340635F9F3432ACDEDEAA9158D8631C9F65AE05C420A5483786BFD1FB6CD1F80A96E9EF161B6035EFD6A232BCF470200F357E36D9042C90E1E3709F704B2D
Malicious:	false
Preview:	[ 150.360] (--) Log file renamed from "/var/log/Xorg.pid-5685.log" to "/var/log/Xorg.0.log".[ 150.402] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 150.439] Build Operating System: linux Ubuntu.[ 150.460] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 150.476] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 150.504] Build Date: 06 July 2021 10:17:51AM.[ 150.518] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 150.533] Current version of pixman: 0.38.4.[ 150.551] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 150.571] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.97161007435243
Encrypted:	false
SSDEEP:	48:rYSvdSfVjvXa8ZrCgNKKkO3/ZrboJZrCn:1vUfNvq8Bkk/aq
MD5:	9AFFD2D6582C532CC0B6E7AD5048918E
SHA1:	489CA113B1FA66951B3AE2B52696042B6DAB289E
SHA-256:	4E231AFEB228C327EEE9FD9FB327121DF6E818828060801E8AC3F956C4F26246
SHA-512:	368B51D9F03561ADFBF97D5205A9A42CE26478A1601EFDC9476CC53641C162A8A147A518AA0E35BF87EC3E67DCA569AC5F4A2C2656D7F91590EA667708D556F5
Malicious:	false
Preview:	Oct 6 15:21:51 galassia systemd-logind[5498]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 6 15:21:51 galassia systemd-logind[5498]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 6 15:21:51 galassia systemd-logind[5498]: User enumeration failed: Invalid argument.Oct 6 15:21:51 galassia systemd-logind[5498]: User of session c2 not known..Oct 6 15:21:51 galassia systemd-logind[5498]: User of session 2 not known..Oct 6 15:21:51 galassia systemd-logind[5498]: Session enumeration failed: No such file or directory.Oct 6 15:21:51 galassia systemd-logind[5498]: Watching system buttons on /dev/input/event0 (Power Button).Oct 6 15:21:51 galassia systemd-logind[5498]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Oct 6 15:21:51 galassia systemd-logind[5498]: New seat seat0..Oct 6 15:21:51 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Oct 6 15:21:51 ga

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	42947
Entropy (8bit):	4.706735299709069
Encrypted:	false
SSDEEP:	192:3VqovZynyiveYHEW6XOj9irXrBfjf/UpIDIyICIfZuI7sWGq4+0kCKxOCLofM0+v:IJ+xbprncTDBuI7s+0n5C0t0UmV9JALG
MD5:	71B98176E8E6433C03B4D03280AE576B
SHA1:	6C42ACCEBC7265AA5BDA480C90C90CE187D3A8BB
SHA-256:	46FA3707E1E66503DD7FDCBDD0AC5FEDDE3BE3E5F244DADAFCAD1F105FBCE7A2
SHA-512:	02B646893FA569343CC00AA824534C3D7310D1BA6BBCDCE51FD0A13662135411F5DC936AEB5FC949368914C228CFA14394D6AC3EA8DCF0618B6C1CE5F8C4C8EE
Malicious:	false
Preview:	Oct 6 15:21:48 galassia kernel: [ 115.225532] blocking signal 9: 5431 -> 936.Oct 6 15:21:48 galassia kernel: [ 115.286966] blocking signal 9: 5431 -> 1400.Oct 6 15:21:48 galassia kernel: [ 115.769450] blocking signal 9: 5431 -> 1805.Oct 6 15:21:48 galassia kernel: [ 116.000663] blocking signal 9: 5431 -> 3069.Oct 6 15:21:48 galassia kernel: [ 116.123006] blocking signal 9: 5431 -> 3132.Oct 6 15:21:48 galassia kernel: [ 116.805611] New task spawned: old: (tgid 5483, tid 5483), new (tgid: 5483, tid: 5489).Oct 6 15:21:48 galassia kernel: [ 116.806992] New task spawned: old: (tgid 5483, tid 5483), new (tgid: 5483, tid: 5490).Oct 6 15:21:48 galassia kernel: [ 116.818616] New task spawned: old: (tgid 5483, tid 5489), new (tgid: 5483, tid: 5491).Oct 6 15:21:48 galassia kernel: [ 116.958257] blocking signal 9: 5437 -> 660.Oct 6 15:21:48 galassia kernel: [ 116.998142] blocking signal 9: 5437 -> 726.Oct 6 15:21:48 galassia kernel: [ 117.021062] blocking signal 9: 5437 -> 77

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	151751
Entropy (8bit):	5.19592476637585
Encrypted:	false
SSDEEP:	768:NR14Vu0LVMl+q2PiGzsmz9VMpwSus2cTwxBuO7UECSJNq0PHZrqM2X2I2yluGn9U:EumzEpQBmECSJ00I9p6UmUq
MD5:	9F0F1B871C1BC8AEC603C2ACDB45F2E1
SHA1:	F4FC962FE5931893F7F576E42E3BA606838FFFD4
SHA-256:	E2B4F38D43F0BC104C3F4BF3E22C1C5D237AF7BF9A1A92304A5960B86C9B1570
SHA-512:	5E149C1A1FF76A022B216312AFD0737BECB6CF12A1693EE81FF40C07070DADA07C2184424839A0063F41CE8FB058FF0832699FE2C33506907AA5D83765B03F61
Malicious:	false
Preview:	Oct 6 15:21:47 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 6 15:21:48 galassia kernel: [ 115.225532] blocking signal 9: 5431 -> 936.Oct 6 15:21:47 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 6 15:21:48 galassia kernel: [ 115.286966] blocking signal 9: 5431 -> 1400.Oct 6 15:21:48 galassia kernel: [ 115.769450] blocking signal 9: 5431 -> 1805.Oct 6 15:21:48 galassia kernel: [ 116.000663] blocking signal 9: 5431 -> 3069.Oct 6 15:21:48 galassia kernel: [ 116.123006] blocking signal 9: 5431 -> 3132.Oct 6 15:21:48 galassia kernel: [ 116.805611] New task spawned: old: (tgid 5483, tid 5483), new (tgid: 5483, tid: 5489).Oct 6 15:21:47 galassia systemd[2935]: pulseaudio.service: Scheduled restart job, restart counter is at 1..Oct 6 15:21:47 galassia systemd[2935]: Stopped Sound Service..Oct 6 15:21:47 galassia systemd[2935]: Starting Sound Service....Oct 6 15:21:47 galassia systemd[1]: rsyslog.service: Sch

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:6lSsXlXEWtl/0G///:6h+ylh
MD5:	26FD38A4128BE2BC152BDBBAEEE6CB52
SHA1:	E28B168C30991B8F50CE9F0C8325159508DF0ED9
SHA-256:	2A5DE102CBBAAA8BA820AF073EDE497C20A56C2D70B7D38FE8C92E80D740CFD2
SHA-512:	5984D20210DEAAB18353C82D99DEBD9B2E9D4E420728194FEFB6F90005921726BE17690C531F261B1AAB72465D0D347A16BE82CEEA242BD22B0C219201F7D9D3
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN..................................................................................................................................................................................................................................................................................................._..g&.......................................

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.533487303636356
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	85'696 bytes
MD5:	e6718d618bf29c3adc96d6bb20698261
SHA1:	356af267276553427c895b739c92c233635a6021
SHA256:	7022bf8444420bf01377e40835020fc284f902163c6997933e083a0f21c52f42
SHA512:	a6cb2ddd0c9f67ab7f4e4c2c3249a411111736735e2f60793173689cc077de012fd418e0bec0661ab435cb082d011d59cfd50e97cb34b65ef61ced5578686713
SSDEEP:	1536:7vkLyVw/Srsg/Bl91EdkEDRXE1uMvc4wkESd:7vkOKgoTtXEgGbL
TLSH:	4083E806BF651FFBDC5FCD374AA9170128CC691A22A53B357A74D818F64B24F0AE3864
File Content Preview:	.ELF....................`.@.4....L......4. ...(...............@...@..C...C...............C...CE..CE.....l+..........Q.td...............................<<..'!......'.......................<...'!... .........9'.. ........................<...'!............+9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	85136
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x12b00	0x0	0x6	AX	16
.fini	PROGBITS	0x412c20	0x12c20	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x412c80	0x12c80	0x1710	0x0	0x2	A	16
.ctors	PROGBITS	0x454394	0x14394	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45439c	0x1439c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x4543a8	0x143a8	0xc	0x0	0x3	WA	4
.data	PROGBITS	0x4543c0	0x143c0	0x420	0x0	0x3	WA	16
.got	PROGBITS	0x4547e0	0x147e0	0x44c	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x454c2c	0x14c2c	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x454c50	0x14c2c	0x22b0	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x9a2	0x14c2c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x14c2c	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x14390	0x14390	5.5572	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x14394	0x454394	0x454394	0x898	0x2b6c	3.7887	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 22:21:44.660032988 CEST	192.168.2.13	8.8.8.8	0xf24b	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:21:46.034672022 CEST	192.168.2.13	8.8.8.8	0xe96b	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:21:46.784429073 CEST	192.168.2.13	8.8.8.8	0xeb1e	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 22:21:44.666798115 CEST	8.8.8.8	192.168.2.13	0xf24b	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:21:46.041315079 CEST	8.8.8.8	192.168.2.13	0xe96b	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:21:46.791701078 CEST	8.8.8.8	192.168.2.13	0xeb1e	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false

Start time (UTC):	20:21:43
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	20:21:44
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	20:21:47
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:21:50
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:21:51
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:21:52
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:21:53
Start date (UTC):	06/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:21:54
Start date (UTC):	06/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:21:55
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:21:56
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:22:06
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:22:08
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:22:11
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:22:12
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5633/oom_score_adj

/proc/5636/oom_score_adj

/proc/5638/oom_score_adj

/proc/5640/oom_score_adj

/proc/5642/oom_score_adj

/proc/5644/oom_score_adj

/proc/5647/oom_score_adj

/proc/5721/oom_score_adj

/proc/5751/oom_score_adj

/proc/5754/oom_score_adj

/proc/5756/oom_score_adj

/proc/5758/oom_score_adj

/proc/5760/oom_score_adj

/proc/5762/oom_score_adj

/proc/5765/oom_score_adj

/proc/5947/oom_score_adj

/proc/6000/oom_score_adj

/proc/6121/oom_score_adj

/proc/6335/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1ITVSTV

/run/systemd/inhibit/.#29ScS2W

/run/systemd/inhibit/.#37BJ6IX

/run/systemd/inhibit/.#4gOVR4U

Linux Analysis Report
na.elf

Start time (UTC):	20:22:13
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:22:14
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:22:15
Start date (UTC):	06/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	20:22:20
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:22:22
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:22:35
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:22:36
Start date (UTC):	06/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:23:12
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:22:44
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	20:22:52
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c