Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1527295
MD5: 9eef3745fa9ab355e2300ab5f3ac14b6
SHA1: fcc3c4abb47024784d83b711206c374cae360e09
SHA256: 4338bf50d8af5196c52c91e76e6ae279ed45517d2afd65bc82ef7dc2a74a879b
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Yara detected Mirai
Yara detected Okiru
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Deletes log files
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Found strings indicative of a multi-platform dropper
Reads CPU information from /sys indicative of miner or evasive malware
Reads system version information
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 70%
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pulseaudio (PID: 5592) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5699) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5842) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5882) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6105) Reads CPU info from /sys: /sys/devices/system/cpu/online
Found strings indicative of a multi-platform dropper
Source: na.elf String: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:46974 -> 154.216.20.119:777
Reads the 'hosts' file potentially containing internal network hosts
Source: /usr/sbin/rsyslogd (PID: 5593) Reads hosts file: /etc/hosts Jump to behavior
Sample listens on a socket
Source: /usr/sbin/gdm3 (PID: 5705) Socket: unknown address family Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5741) Socket: unknown address family Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5742) Socket: unknown address family Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5819) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5841) Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5820) Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5940) Socket: unknown address family
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 188.159.123.233
Source: unknown TCP traffic detected without corresponding DNS query: 219.197.78.69
Source: unknown TCP traffic detected without corresponding DNS query: 106.123.252.65
Source: unknown TCP traffic detected without corresponding DNS query: 111.214.5.160
Source: unknown TCP traffic detected without corresponding DNS query: 159.114.91.235
Source: unknown TCP traffic detected without corresponding DNS query: 147.244.60.41
Source: unknown TCP traffic detected without corresponding DNS query: 183.7.226.168
Source: unknown TCP traffic detected without corresponding DNS query: 66.159.218.116
Source: unknown TCP traffic detected without corresponding DNS query: 18.156.48.43
Source: unknown TCP traffic detected without corresponding DNS query: 2.173.228.190
Source: unknown TCP traffic detected without corresponding DNS query: 57.125.20.224
Source: unknown TCP traffic detected without corresponding DNS query: 187.195.196.225
Source: unknown TCP traffic detected without corresponding DNS query: 17.186.143.179
Source: unknown TCP traffic detected without corresponding DNS query: 205.166.45.98
Source: unknown TCP traffic detected without corresponding DNS query: 40.162.238.99
Source: unknown TCP traffic detected without corresponding DNS query: 120.35.207.229
Source: unknown TCP traffic detected without corresponding DNS query: 58.8.50.75
Source: unknown TCP traffic detected without corresponding DNS query: 179.227.140.186
Source: unknown TCP traffic detected without corresponding DNS query: 79.68.32.255
Source: unknown TCP traffic detected without corresponding DNS query: 189.183.56.1
Source: unknown TCP traffic detected without corresponding DNS query: 222.30.67.55
Source: unknown TCP traffic detected without corresponding DNS query: 157.112.183.249
Source: unknown TCP traffic detected without corresponding DNS query: 186.43.162.41
Source: unknown TCP traffic detected without corresponding DNS query: 133.66.229.13
Source: unknown TCP traffic detected without corresponding DNS query: 107.159.180.224
Source: unknown TCP traffic detected without corresponding DNS query: 117.127.229.80
Source: unknown TCP traffic detected without corresponding DNS query: 86.161.44.241
Source: unknown TCP traffic detected without corresponding DNS query: 221.6.76.252
Source: unknown TCP traffic detected without corresponding DNS query: 66.170.223.49
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.231.120
Source: unknown TCP traffic detected without corresponding DNS query: 96.41.153.145
Source: unknown TCP traffic detected without corresponding DNS query: 23.133.4.209
Source: unknown TCP traffic detected without corresponding DNS query: 121.52.124.23
Source: unknown TCP traffic detected without corresponding DNS query: 66.208.107.35
Source: unknown TCP traffic detected without corresponding DNS query: 153.24.199.237
Source: unknown TCP traffic detected without corresponding DNS query: 166.228.65.201
Source: unknown TCP traffic detected without corresponding DNS query: 8.17.4.40
Source: unknown TCP traffic detected without corresponding DNS query: 50.43.57.62
Source: unknown TCP traffic detected without corresponding DNS query: 154.97.54.204
Source: unknown TCP traffic detected without corresponding DNS query: 202.20.42.9
Source: unknown TCP traffic detected without corresponding DNS query: 73.73.29.246
Source: unknown TCP traffic detected without corresponding DNS query: 98.84.235.99
Source: unknown TCP traffic detected without corresponding DNS query: 38.7.68.211
Source: unknown TCP traffic detected without corresponding DNS query: 128.175.12.43
Source: unknown TCP traffic detected without corresponding DNS query: 71.140.33.120
Source: unknown TCP traffic detected without corresponding DNS query: 130.104.171.198
Source: unknown TCP traffic detected without corresponding DNS query: 196.102.142.120
Source: unknown TCP traffic detected without corresponding DNS query: 63.131.31.105
Source: unknown TCP traffic detected without corresponding DNS query: 104.240.238.58
Source: unknown TCP traffic detected without corresponding DNS query: 5.171.198.140
Source: global traffic DNS traffic detected: DNS query: byte-mirai.kro.kr
Source: Xorg.0.log.151.dr, syslog.24.dr String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.151.dr, syslog.24.dr String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.24.dr String found in binary or memory: https://www.rsyslog.com
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary
barindex
Sample tries to kill a massive number of system processes
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 135, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 348, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 661, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 671, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 683, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 684, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 725, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 785, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 791, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 797, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 940, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent to PID below 1000: pid: 941, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 135, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 348, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 661, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 671, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 683, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 684, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 725, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 940, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent to PID below 1000: pid: 941, result: successful Jump to behavior
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 135, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 348, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 661, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 671, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 683, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 684, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 725, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 785, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 791, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 797, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 941, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1589, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1873, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 2517, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 2672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 2991, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3094, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3760, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3761, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3762, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3763, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 5512, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 5536, result: unknown Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 135, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 348, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 661, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 671, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 683, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 684, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 725, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 941, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1589, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1873, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 2517, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 2672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3094, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3760, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3761, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3762, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3763, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 5539, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 5542, result: unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5819) SIGKILL sent: pid: 5835, result: successful
Source: /usr/bin/dbus-daemon (PID: 5819) SIGKILL sent: pid: 6058, result: successful
Source: /usr/bin/dbus-daemon (PID: 5819) SIGKILL sent: pid: 6232, result: successful
Source: /usr/bin/dbus-daemon (PID: 5841) SIGKILL sent: pid: 6215, result: successful
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 135, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 348, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 661, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 671, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 683, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 684, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 725, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 785, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 791, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 797, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 941, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1589, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 1873, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 2517, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 2672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 2991, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3094, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3760, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3761, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3762, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 3763, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 5512, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5536) SIGKILL sent: pid: 5536, result: unknown Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 135, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 348, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 661, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 671, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 683, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 684, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 725, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 941, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1589, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 1873, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 2517, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 2672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3094, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3760, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3761, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3762, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 3763, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 5539, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5542) SIGKILL sent: pid: 5542, result: unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5819) SIGKILL sent: pid: 5835, result: successful
Source: /usr/bin/dbus-daemon (PID: 5819) SIGKILL sent: pid: 6058, result: successful
Source: /usr/bin/dbus-daemon (PID: 5819) SIGKILL sent: pid: 6232, result: successful
Source: /usr/bin/dbus-daemon (PID: 5841) SIGKILL sent: pid: 6215, result: successful
Source: classification engine Classification label: mal92.spre.troj.linELF@0/96@3/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 5591) File: /proc/5591/mounts Jump to behavior
Source: /bin/fusermount (PID: 5594) File: /proc/5594/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5685) File: /proc/5685/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5741) File: /proc/5741/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5819) File: /proc/5819/mounts
Source: /usr/bin/dbus-daemon (PID: 5841) File: /proc/5841/mounts
Source: /usr/bin/gjs (PID: 6233) File: /proc/6233/mounts
Source: /usr/bin/gnome-shell (PID: 5882) File: /proc/5882/mounts
Source: /usr/bin/dbus-daemon (PID: 5736) File: /proc/5736/mounts
Creates hidden files and/or directories
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/seats/.#seat0uX885f Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#127Sixrrg Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#127yIwwQg Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (20)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (19)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/seats/.#seat0PhkICh Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#127iDUVyf Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c1F1CVsh Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#127F4V1Fg Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/seats/.#seat0cqh8Ve Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#127IFZJBd Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c1mUgEOd Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c1Ze4Y4g Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#12752X3Kd Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c17OMG8g Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c1nf6zDe Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c16G4UWe Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#1276vThSf Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/seats/.#seat0KSB5wf Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#1272MKyRh Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/seats/.#seat03JEbje Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#1279Lil8g Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/seats/.#seat0lYi1if Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#127seMrxd Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c2phYAzh Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#127VV4kNe Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/seats/.#seat0dHDHef Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c2mCwXjg Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c2VoFVCf Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/users/.#127yCK72g Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c2w4jJwf Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (21)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (20)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c2gorHUf Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (21)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c2mxWqQg Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c2Pr9MZf Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (24)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/sessions/.#c2hTmXwf Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/inhibit/.#1WTTKwh Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/inhibit/.#2ZhUHMe Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/inhibit/.#3obreTd Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608) File: /run/systemd/inhibit/.#4FlvpTf Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5668) Directory: /root/.cache Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5764) Directory: <invalid fd (11)>/.. Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5764) Directory: <invalid fd (10)>/.. Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799) Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5799) Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821) Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5842) Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852) Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5882) Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5882) Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5882) Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5882) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5882) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5882) Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5882) Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6055) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6055) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6255) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6255) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6259) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6259) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6260) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6260) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6262) Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6262) Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266) Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6283) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6283) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713) Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713) Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6067) Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6067) Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6229) Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6304) Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6487) Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6487) Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6546) Directory: /var/lib/colord/.cache
Enumerates processes within the "proc" file system
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6450/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6253/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5882/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5610/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5797/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6304/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6546/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6105/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6105/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6105/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6226/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5799/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6108/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6108/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6229/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6229/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5734/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5713/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/2946/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6706/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5591/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5591/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5592/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5592/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5592/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5790/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5790/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6262/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6262/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6067/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6223/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6487/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6266/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5730/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5730/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6261/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6283/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6260/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5904/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/1/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5608/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/1364/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5764/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5742/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5820/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6259/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5668/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/6558/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591) File opened: /proc/5705/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/3760/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/3761/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/1583/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/2672/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/19/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/240/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/3094/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/242/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/244/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/1589/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/245/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/246/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/5/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/247/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/248/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/128/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/7/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/249/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/8/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/129/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5542) File opened: /proc/3762/cmdline Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/bin/gpu-manager (PID: 5677) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5680) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5682) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5686) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5688) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5692) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5694) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5696) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5811) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6056) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5727) Shell command executed: sh -c "locale -a | grep -F .utf8 "
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5679) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5681) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5683) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5687) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5691) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5693) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5695) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5697) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5729) Grep executable: /usr/bin/grep -> grep -F .utf8
Executes the "kill" or "pkill" command typically used to terminate processes
Source: /usr/share/gdm/generate-config (PID: 5699) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Reads system version information
Source: /sbin/agetty (PID: 5672) Reads version info: /etc/issue Jump to behavior
Sample tries to set the executable flag
Source: /usr/sbin/gdm3 (PID: 5705) File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5705) File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/rsyslogd (PID: 5593) Log file created: /var/log/kern.log Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5593) Log file created: /var/log/auth.log Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5676) Log file created: /var/log/gpu-manager.log Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5799) Log file created: /var/log/Xorg.0.log Jump to dropped file
Deletes log files
Source: /usr/bin/gpu-manager (PID: 5676) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799) Truncated file: /var/log/Xorg.pid-5799.log
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pulseaudio (PID: 5592) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5699) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5842) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5882) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6105) Reads CPU info from /sys: /sys/devices/system/cpu/online
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5533) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5592) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5593) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5672) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5676) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5730) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5742) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5790) Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5797) Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5799) Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5836) Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6216) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5820) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5842) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852) Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5882) Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6055) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6255) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6259) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6260) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6264) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6266) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6283) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6105) Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6226) Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6229) Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6304) Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6706) Queries kernel information via 'uname':
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.448] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.116] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.270] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 176.854] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.817] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.068] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.401] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.482] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.838] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.607] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.638] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.180] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): DPI set to (96, 96)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.502] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.025] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.077] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.019] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.853] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.045] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.022] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.708] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.466] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.846] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.176] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.054] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.765] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.628] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.311] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.568] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.207] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.966] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.254] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.281] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.803] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.403] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.010] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.659] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 176.864] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.258] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.508] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.882] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.428] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.915] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.445] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.962] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.766] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: na.elf, 5536.1.00007ffdca114000.00007ffdca135000.rw-.sdmp Binary or memory string: ARV/tmp/qemu-open.lf8ajM
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.910] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.843] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.812] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.742] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.087] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.213] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.993] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.874] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr Binary or memory string: [ 172.853] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.122] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.324] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.094] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.379] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.548] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.961] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.367] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.110] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.771] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.077] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.814] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.772] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.830] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.391] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (WW) vmware(0): Disabling 3D support.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.229] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.430] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.014] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.945] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.700] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.026] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.354] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.118] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 172.875] (II) LoadModule: "vmware"
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.670] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.115] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.375] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.259] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.301] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: na.elf, 5533.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5536.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5538.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5539.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5542.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5544.1.00007ffdca114000.00007ffdca135000.rw-.sdmp Binary or memory string: VSx86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.745] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.787] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.900] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.942] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.384] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.937] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.491] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.603] (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.453] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.796] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.369] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.751] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.464] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.504] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.411] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.393] (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.343] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.678] (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.936] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.357] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.514] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.559] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.191] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.969] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.714] (==) vmware(0): Using HW cursor
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.403] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.053] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.800] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.966] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.680] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.973] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.068] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.565] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.533] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.831] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 176.888] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: na.elf, 5542.1.00007ffdca114000.00007ffdca135000.rw-.sdmp Binary or memory string: /tmp/qemu-open.PZDETe
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.218] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.642] (--) vmware(0): w.grn: 8
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.166] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.474] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 176.873] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.445] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.411] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.555] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.825] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.207] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.539] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.695] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: na.elf, 5533.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5536.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5538.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5539.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5542.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5544.1.00005652447fd000.000056524492b000.rw-.sdmp Binary or memory string: DRV!/etc/qemu-binfmt/arm
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.748] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.697] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.099] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.071] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.084] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.365] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.762] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.033] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.758] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.929] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.268] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.639] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.028] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.570] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.393] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 173.219] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.329] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.196] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.864] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.577] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.738] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.036] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.191] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.958] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.634] (--) vmware(0): w.red: 8
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Using HW cursor
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Backing store enabled
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.844] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.460] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.731] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.540] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.598] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.186] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.705] (==) vmware(0): Default visual is TrueColor
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.435] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.613] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.105] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.668] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.497] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.526] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.138] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.211] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.291] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 172.887] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.731] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.223] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.190] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.457] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.661] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.026] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.897] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.322] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.338] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.172] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.466] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.062] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.773] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.007] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.056] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.981] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.978] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.616] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.721] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.810] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.805] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.403] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: na.elf, 5542.1.00007ffdca114000.00007ffdca135000.rw-.sdmp Binary or memory string: ARV/tmp/qemu-open.PZDETe
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.734] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.992] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.654] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.518] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.605] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.661] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.741] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: na.elf, 5533.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5536.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5538.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5539.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5542.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5544.1.00007ffdca114000.00007ffdca135000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.540] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.467] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.275] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.520] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.864] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.946] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.567] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.803] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.834] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.878] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.865] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.727] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.042] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.380] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.754] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 172.932] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.980] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.323] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.718] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.193] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.249] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.759] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.275] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.647] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.101] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.752] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.797] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.348] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.480] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.684] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.287] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.126] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.728] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.144] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.819] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.131] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.042] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.830] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.707] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.867] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.000] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.763] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.997] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.458] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.419] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 189.309] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.301] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.292] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.158] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.168] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: na.elf, 5536.1.00007ffdca114000.00007ffdca135000.rw-.sdmp Binary or memory string: /tmp/qemu-open.lf8ajM
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.698] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.625] (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.148] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.300] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.286] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.634] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.494] (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.743] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.691] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 181.139] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.418] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.058] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.125] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.088] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.204] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.854] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.890] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.858] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Default visual is TrueColor
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.786] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.795] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.420] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) LoadModule: "vmware"
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.674] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.580] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.051] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.049] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.850] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.938] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.725] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): depth: 24
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.436] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.486] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (EE) vmware(0): Failed to open drm.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.014] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.779] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.062] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.605] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.098] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 173.083] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.239] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.311] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 188.208] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.736] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.151.dr Binary or memory string: [ 178.313] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 177.501] (--) vmware(0): vram: 4194304
Source: na.elf, 5533.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5536.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5538.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5539.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5542.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5544.1.00005652447fd000.000056524492b000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.824] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr Binary or memory string: [ 179.849] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.24.dr Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr Binary or memory string: [ 180.579] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz

Language, Device and Operating System Detection
barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713) Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5533, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5536, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5538, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5539, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5544, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5533, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5536, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5538, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5539, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5542, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5544, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5533, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5536, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5538, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5539, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5544, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5533, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5536, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5538, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5539, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5542, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5544, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
41.148.196.219
 unknown South Africa
5713 SAIX-NETZA false
17.57.22.235
 unknown United States
714 APPLE-ENGINEERINGUS false
178.60.249.95
 unknown Spain
12334 Galicia-SpainES false
77.109.157.82
 unknown Switzerland
13030 INIT7CH false
212.20.44.120
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
94.85.243.59
 unknown Italy
3269 ASN-IBSNAZIT false
90.247.48.210
 unknown United Kingdom
5378 VodafoneGB false
171.95.134.236
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
95.215.48.36
 unknown Ukraine
48882 OPTIMA-SHID-ASUA false
194.144.71.98
 unknown Iceland
12969 VODAFONE_ICELANDIS false
81.6.26.135
 unknown Switzerland
1836 GREENgreenchAGAutonomousSystemEU false
142.92.161.138
 unknown Canada
818 DOC-ASCA false
49.10.66.205
 unknown Korea Republic of
9858 KRNICNETKoreaInternetSecurityAgencyKR false
116.133.62.126
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
37.35.209.238
 unknown Spain
12479 UNI2-ASES false
148.56.211.24
 unknown Spain
12430 VODAFONE_ESES false
75.79.174.91
 unknown United States
6498 INTRADO-CORPUS false
38.96.119.2
 unknown United States
174 COGENT-174US false
189.181.178.45
 unknown Mexico
8151 UninetSAdeCVMX false
54.26.137.102
 unknown United States
14618 AMAZON-AESUS false
141.1.252.120
 unknown Germany
1273 CWVodafoneGroupPLCEU false
75.177.252.217
 unknown United States
11426 TWC-11426-CAROLINASUS false
106.114.111.80
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
48.220.92.172
 unknown United States
2686 ATGS-MMD-ASUS false
97.99.35.251
 unknown United States
11427 TWC-11427-TEXASUS false
188.144.124.72
 unknown Germany
12389 ROSTELECOM-ASRU false
41.108.48.173
 unknown Algeria
36947 ALGTEL-ASDZ false
4.207.166.220
 unknown United States
3356 LEVEL3US false
132.147.54.114
 unknown United States
11776 ATLANTICBB-JOHNSTOWNUS false
46.111.236.27
 unknown Russian Federation
2854 ROSPRINT-ASRU false
48.49.26.125
 unknown United States
2686 ATGS-MMD-ASUS false
109.219.227.122
 unknown France
3215 FranceTelecom-OrangeFR false
39.157.9.123
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
110.152.176.180
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
221.120.41.222
 unknown Taiwan; Republic of China (ROC)
17421 EMOME-NETMobileBusinessGroupTW false
90.74.177.140
 unknown France
12479 UNI2-ASES false
145.225.99.177
 unknown Germany
25039 ASN-LINDEKlosterhofstrasse1DE false
170.234.84.201
 unknown United States
11685 HNBCOL-ASUS false
77.198.164.103
 unknown France
15557 LDCOMNETFR false
154.55.185.244
 unknown United States
174 COGENT-174US false
70.66.252.68
 unknown Canada
6327 SHAWCA false
199.119.115.238
 unknown United States
22925 ALLIED-TELECOMUS false
122.208.229.28
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
146.181.14.108
 unknown United States
786 JANETJiscServicesLimitedGB false
81.113.214.164
 unknown Italy
20959 TELECOM-ITALIA-DATA-COMIT false
139.64.243.11
 unknown Reserved
62809 EXPOHLUS false
92.154.45.111
 unknown France
3215 FranceTelecom-OrangeFR false
20.67.73.45
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
67.241.131.123
 unknown United States
11351 TWC-11351-NORTHEASTUS false
87.248.145.178
 unknown Iran (ISLAMIC Republic Of)
47843 CWM-ASIR false
49.105.53.152
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
175.146.218.189
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
206.163.104.103
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
52.22.221.201
 unknown United States
14618 AMAZON-AESUS false
160.76.36.209
 unknown United States
36693 ALEGENT-HEALTH-1US false
81.48.2.215
 unknown France
3215 FranceTelecom-OrangeFR false
32.201.63.95
 unknown United States
2686 ATGS-MMD-ASUS false
140.146.53.131
 unknown United States
46103 UWW-EDU-ASNUS false
140.135.223.90
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
80.196.122.122
 unknown Denmark
3292 TDCTDCASDK false
71.22.162.223
 unknown United States
7029 WINDSTREAMUS false
49.200.247.241
 unknown India
55441 TTSLMEIS-AS-APTTSL-ISPDIVISIONIN false
174.5.6.59
 unknown Canada
6327 SHAWCA false
221.163.247.124
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
84.82.104.191
 unknown Netherlands
1136 KPNKPNNationalEU false
180.68.127.138
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
173.139.22.69
 unknown United States
10507 SPCSUS false
223.66.110.150
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
81.59.219.35
 unknown Belgium
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
166.75.222.194
 unknown Chile
16629 CTCCORPSATELEFONICAEMPRESASCL false
212.201.98.74
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
176.136.223.224
 unknown France
5410 BOUYGTEL-ISPFR false
36.114.86.25
 unknown China
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
202.114.81.199
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
159.7.232.162
 unknown Sweden
1906 NORTHROP-GRUMMANUS false
59.108.216.166
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
101.63.232.190
 unknown Italy
210278 SKYIT-BBIT false
211.141.188.88
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
37.149.75.37
 unknown Cyprus
31549 RASANAIR false
89.206.103.220
 unknown Switzerland
559 SWITCHPeeringrequestspeeringswitchchEU false
142.220.72.254
 unknown Canada
13576 SDNW-13576US false
196.233.130.48
 unknown Tunisia
37492 ORANGE-TN false
165.204.55.254
 unknown United States
33619 AMD-MARKHAMUS false
155.154.166.83
 unknown United States
1488 DNIC-ASBLK-01488-01489US false
4.131.82.80
 unknown United States
3356 LEVEL3US false
61.235.149.98
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
83.118.208.212
 unknown France
34177 CELESTE-ASCELESTE-InternetservicesproviderFR false
126.139.28.45
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
69.233.21.178
 unknown United States
7018 ATT-INTERNET4US false
113.236.166.136
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
172.147.112.158
 unknown United States
7018 ATT-INTERNET4US false
137.61.4.24
 unknown Sweden
15991 SWEDISH_TAX_AGENCYIT-departmentKortagatan10SE-17194Sol false
128.153.194.132
 unknown United States
92 CLARKSON-ASUS false
85.43.219.86
 unknown Italy
3269 ASN-IBSNAZIT false
184.226.66.6
 unknown United States
10507 SPCSUS false
153.196.225.114
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
69.222.230.189
 unknown United States
7018 ATT-INTERNET4US false
161.153.47.58
 unknown United States
9328 DATACOM-AUDATACOMSYSTEMSAUPTYLTDAU false
46.204.222.204
 unknown Poland
12912 TMPL false
190.20.195.197
 unknown Chile
7418 TELEFONICACHILESACL false

Contacted Domains

Name IP Active
byte-mirai.kro.kr 154.216.20.119 true