Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527295
MD5:	9eef3745fa9ab355e2300ab5f3ac14b6
SHA1:	fcc3c4abb47024784d83b711206c374cae360e09
SHA256:	4338bf50d8af5196c52c91e76e6ae279ed45517d2afd65bc82ef7dc2a74a879b
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527295
Start date and time:	2024-10-06 22:23:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/96@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: na.elf

Process Tree

system is lnxubuntu20

na.elf (PID: 5533, Parent: 5453, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5536, Parent: 5533)

na.elf New Fork (PID: 5538, Parent: 5533)

na.elf New Fork (PID: 5539, Parent: 5533)

na.elf New Fork (PID: 5542, Parent: 5539)

na.elf New Fork (PID: 5544, Parent: 5539)

na.elf New Fork (PID: 5546, Parent: 5539)

na.elf New Fork (PID: 5547, Parent: 5539)

na.elf New Fork (PID: 5550, Parent: 5539)

systemd New Fork (PID: 5591, Parent: 1)

dbus-daemon (PID: 5591, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5592, Parent: 2955)

pulseaudio (PID: 5592, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5593, Parent: 1)

rsyslogd (PID: 5593, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gvfsd-fuse New Fork (PID: 5594, Parent: 3147)

fusermount (PID: 5594, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5608, Parent: 1)

systemd-logind (PID: 5608, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5610, Parent: 1)

rtkit-daemon (PID: 5610, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5668, Parent: 1)

polkitd (PID: 5668, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5672, Parent: 1)

agetty (PID: 5672, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5673, Parent: 1289)

Default (PID: 5673, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5674, Parent: 1289)

Default (PID: 5674, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5675, Parent: 1289)

Default (PID: 5675, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5676, Parent: 1)

gpu-manager (PID: 5676, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5677, Parent: 5676)

sh (PID: 5677, Parent: 5676, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5679, Parent: 5677)

grep (PID: 5679, Parent: 5677, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5680, Parent: 5676)

sh (PID: 5680, Parent: 5676, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5681, Parent: 5680)

grep (PID: 5681, Parent: 5680, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5682, Parent: 5676)

sh (PID: 5682, Parent: 5676, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5683, Parent: 5682)

grep (PID: 5683, Parent: 5682, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5686, Parent: 5676)

sh (PID: 5686, Parent: 5676, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5687, Parent: 5686)

grep (PID: 5687, Parent: 5686, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5688, Parent: 5676)

sh (PID: 5688, Parent: 5676, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5691, Parent: 5688)

grep (PID: 5691, Parent: 5688, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5692, Parent: 5676)

sh (PID: 5692, Parent: 5676, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5693, Parent: 5692)

grep (PID: 5693, Parent: 5692, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5694, Parent: 5676)

sh (PID: 5694, Parent: 5676, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5695, Parent: 5694)

grep (PID: 5695, Parent: 5694, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5696, Parent: 5676)

sh (PID: 5696, Parent: 5676, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5697, Parent: 5696)

grep (PID: 5697, Parent: 5696, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5685, Parent: 2955)

dbus-daemon (PID: 5685, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5698, Parent: 1)

generate-config (PID: 5698, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5699, Parent: 5698)

pkill (PID: 5699, Parent: 5698, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5700, Parent: 1)

gdm-wait-for-drm (PID: 5700, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5705, Parent: 1)

gdm3 (PID: 5705, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5709, Parent: 5705)

plymouth (PID: 5709, Parent: 5705, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5730, Parent: 5705)

gdm-session-worker (PID: 5730, Parent: 5705, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5734, Parent: 5730)

gdm-wayland-session (PID: 5734, Parent: 5730, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5740, Parent: 5734)

dbus-run-session (PID: 5740, Parent: 5734, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5741, Parent: 5740)

dbus-daemon (PID: 5741, Parent: 5740, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5745, Parent: 5741)

dbus-daemon New Fork (PID: 5746, Parent: 5745)

false (PID: 5746, Parent: 5745, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5748, Parent: 5741)

dbus-daemon New Fork (PID: 5749, Parent: 5748)

false (PID: 5749, Parent: 5748, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5750, Parent: 5741)

dbus-daemon New Fork (PID: 5751, Parent: 5750)

false (PID: 5751, Parent: 5750, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5752, Parent: 5741)

dbus-daemon New Fork (PID: 5753, Parent: 5752)

false (PID: 5753, Parent: 5752, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5754, Parent: 5741)

dbus-daemon New Fork (PID: 5755, Parent: 5754)

false (PID: 5755, Parent: 5754, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5756, Parent: 5741)

dbus-daemon New Fork (PID: 5757, Parent: 5756)

false (PID: 5757, Parent: 5756, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5759, Parent: 5741)

dbus-daemon New Fork (PID: 5760, Parent: 5759)

false (PID: 5760, Parent: 5759, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5742, Parent: 5740)

gnome-session (PID: 5742, Parent: 5740, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5742, Parent: 5740, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5761, Parent: 5742)

session-migration (PID: 5761, Parent: 5742, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5764, Parent: 5742)

sh (PID: 5764, Parent: 5742, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5764, Parent: 5742, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5790, Parent: 5705)

gdm-session-worker (PID: 5790, Parent: 5705, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5797, Parent: 5790)

gdm-x-session (PID: 5797, Parent: 5790, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5799, Parent: 5797)

Xorg (PID: 5799, Parent: 5797, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5799, Parent: 5797, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5799, Parent: 5797, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5811, Parent: 5799)

sh (PID: 5811, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5812, Parent: 5811)

xkbcomp (PID: 5812, Parent: 5811, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6056, Parent: 5799)

sh (PID: 6056, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6057, Parent: 6056)

xkbcomp (PID: 6057, Parent: 6056, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5817, Parent: 5797)

Default (PID: 5817, Parent: 5797, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5818, Parent: 5797)

dbus-run-session (PID: 5818, Parent: 5797, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5819, Parent: 5818)

dbus-daemon (PID: 5819, Parent: 5818, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5835, Parent: 5819)

dbus-daemon New Fork (PID: 5836, Parent: 5835)

at-spi-bus-launcher (PID: 5836, Parent: 5835, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5841, Parent: 5836)

dbus-daemon (PID: 5841, Parent: 5836, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6215, Parent: 5841)

dbus-daemon New Fork (PID: 6216, Parent: 6215)

at-spi2-registryd (PID: 6216, Parent: 6215, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5863, Parent: 5819)

dbus-daemon New Fork (PID: 5864, Parent: 5863)

false (PID: 5864, Parent: 5863, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5868, Parent: 5819)

dbus-daemon New Fork (PID: 5869, Parent: 5868)

false (PID: 5869, Parent: 5868, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5870, Parent: 5819)

dbus-daemon New Fork (PID: 5871, Parent: 5870)

false (PID: 5871, Parent: 5870, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5872, Parent: 5819)

dbus-daemon New Fork (PID: 5873, Parent: 5872)

false (PID: 5873, Parent: 5872, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5874, Parent: 5819)

dbus-daemon New Fork (PID: 5875, Parent: 5874)

false (PID: 5875, Parent: 5874, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5876, Parent: 5819)

dbus-daemon New Fork (PID: 5877, Parent: 5876)

false (PID: 5877, Parent: 5876, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5879, Parent: 5819)

dbus-daemon New Fork (PID: 5880, Parent: 5879)

false (PID: 5880, Parent: 5879, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6058, Parent: 5819)

dbus-daemon New Fork (PID: 6059, Parent: 6058)

ibus-portal (PID: 6059, Parent: 6058, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6232, Parent: 5819)

dbus-daemon New Fork (PID: 6233, Parent: 6232)

gjs (PID: 6233, Parent: 6232, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6451, Parent: 5819)

dbus-daemon New Fork (PID: 6452, Parent: 6451)

false (PID: 6452, Parent: 6451, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5820, Parent: 5818)

gnome-session (PID: 5820, Parent: 5818, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5820, Parent: 5818, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5821, Parent: 5820)

gnome-session-check-accelerated (PID: 5821, Parent: 5820, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5842, Parent: 5821)

gnome-session-check-accelerated-gl-helper (PID: 5842, Parent: 5821, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5852, Parent: 5821)

gnome-session-check-accelerated-gles-helper (PID: 5852, Parent: 5821, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5881, Parent: 5820)

session-migration (PID: 5881, Parent: 5820, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5882, Parent: 5820)

sh (PID: 5882, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5882, Parent: 5820, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5940, Parent: 5882)

ibus-daemon (PID: 5940, Parent: 5882, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6052, Parent: 5940)

ibus-memconf (PID: 6052, Parent: 5940, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6054, Parent: 5940)

ibus-daemon New Fork (PID: 6055, Parent: 6054)

ibus-x11 (PID: 6055, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6287, Parent: 5940)

ibus-engine-simple (PID: 6287, Parent: 5940, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6253, Parent: 5820)

sh (PID: 6253, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6253, Parent: 5820, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6255, Parent: 5820)

sh (PID: 6255, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6255, Parent: 5820, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6259, Parent: 5820)

sh (PID: 6259, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6259, Parent: 5820, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6260, Parent: 5820)

sh (PID: 6260, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6260, Parent: 5820, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6261, Parent: 5820)

sh (PID: 6261, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6261, Parent: 5820, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6427, Parent: 6261)

gsd-print-notifications New Fork (PID: 6450, Parent: 6427)

gsd-printer (PID: 6450, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6262, Parent: 5820)

sh (PID: 6262, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6262, Parent: 5820, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6264, Parent: 5820)

sh (PID: 6264, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6264, Parent: 5820, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6265, Parent: 5820)

sh (PID: 6265, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6265, Parent: 5820, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6266, Parent: 5820)

sh (PID: 6266, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6266, Parent: 5820, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6270, Parent: 5820)

sh (PID: 6270, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6270, Parent: 5820, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6271, Parent: 5820)

sh (PID: 6271, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6271, Parent: 5820, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6275, Parent: 5820)

sh (PID: 6275, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6275, Parent: 5820, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6280, Parent: 5820)

sh (PID: 6280, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6280, Parent: 5820, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6283, Parent: 5820)

sh (PID: 6283, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6283, Parent: 5820, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6700, Parent: 5820)

sh (PID: 6700, Parent: 5820, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6700, Parent: 5820, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gdm3 New Fork (PID: 5791, Parent: 5705)

Default (PID: 5791, Parent: 5705, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5792, Parent: 5705)

Default (PID: 5792, Parent: 5705, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5713, Parent: 1)

accounts-daemon (PID: 5713, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5725, Parent: 5713)

language-validate (PID: 5725, Parent: 5713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5726, Parent: 5725)

language-options (PID: 5726, Parent: 5725, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5727, Parent: 5726)

sh (PID: 5727, Parent: 5726, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5728, Parent: 5727)

locale (PID: 5728, Parent: 5727, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5729, Parent: 5727)

grep (PID: 5729, Parent: 5727, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5736, Parent: 1299)

dbus-daemon (PID: 5736, Parent: 1299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5904, Parent: 1)

systemd-localed (PID: 5904, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6067, Parent: 1)

upowerd (PID: 6067, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6105, Parent: 1299)

pulseaudio (PID: 6105, Parent: 1299, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6108, Parent: 1)

geoclue (PID: 6108, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6223, Parent: 1)

wpa_supplicant (PID: 6223, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6226, Parent: 1)

avahi-daemon (PID: 6226, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6228, Parent: 6226)

systemd New Fork (PID: 6229, Parent: 1)

packagekitd (PID: 6229, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6248, Parent: 6229)

dpkg (PID: 6248, Parent: 6229, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6304, Parent: 1)

systemd-hostnamed (PID: 6304, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6487, Parent: 1)

ModemManager (PID: 6487, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6546, Parent: 1)

colord (PID: 6546, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6706, Parent: 6546)

colord-sane (PID: 6706, Parent: 6546, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6558, Parent: 1)

systemd-localed (PID: 6558, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5533	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5533	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5536	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5536	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5538	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5538	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5539	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5539	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5542	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5544	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5544	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 18 entries

String: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: global traffic

TCP traffic: 192.168.2.14:46974 -> 154.216.20.119:777

Source: /usr/sbin/rsyslogd (PID: 5593)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5705)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5741)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5742)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5819)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5841)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5820)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5940)	Socket: unknown address family

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 188.159.123.233
Source: unknown	TCP traffic detected without corresponding DNS query: 219.197.78.69
Source: unknown	TCP traffic detected without corresponding DNS query: 106.123.252.65
Source: unknown	TCP traffic detected without corresponding DNS query: 111.214.5.160
Source: unknown	TCP traffic detected without corresponding DNS query: 159.114.91.235
Source: unknown	TCP traffic detected without corresponding DNS query: 147.244.60.41
Source: unknown	TCP traffic detected without corresponding DNS query: 183.7.226.168
Source: unknown	TCP traffic detected without corresponding DNS query: 66.159.218.116
Source: unknown	TCP traffic detected without corresponding DNS query: 18.156.48.43
Source: unknown	TCP traffic detected without corresponding DNS query: 2.173.228.190
Source: unknown	TCP traffic detected without corresponding DNS query: 57.125.20.224
Source: unknown	TCP traffic detected without corresponding DNS query: 187.195.196.225
Source: unknown	TCP traffic detected without corresponding DNS query: 17.186.143.179
Source: unknown	TCP traffic detected without corresponding DNS query: 205.166.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 40.162.238.99
Source: unknown	TCP traffic detected without corresponding DNS query: 120.35.207.229
Source: unknown	TCP traffic detected without corresponding DNS query: 58.8.50.75
Source: unknown	TCP traffic detected without corresponding DNS query: 179.227.140.186
Source: unknown	TCP traffic detected without corresponding DNS query: 79.68.32.255
Source: unknown	TCP traffic detected without corresponding DNS query: 189.183.56.1
Source: unknown	TCP traffic detected without corresponding DNS query: 222.30.67.55
Source: unknown	TCP traffic detected without corresponding DNS query: 157.112.183.249
Source: unknown	TCP traffic detected without corresponding DNS query: 186.43.162.41
Source: unknown	TCP traffic detected without corresponding DNS query: 133.66.229.13
Source: unknown	TCP traffic detected without corresponding DNS query: 107.159.180.224
Source: unknown	TCP traffic detected without corresponding DNS query: 117.127.229.80
Source: unknown	TCP traffic detected without corresponding DNS query: 86.161.44.241
Source: unknown	TCP traffic detected without corresponding DNS query: 221.6.76.252
Source: unknown	TCP traffic detected without corresponding DNS query: 66.170.223.49
Source: unknown	TCP traffic detected without corresponding DNS query: 193.161.231.120
Source: unknown	TCP traffic detected without corresponding DNS query: 96.41.153.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.133.4.209
Source: unknown	TCP traffic detected without corresponding DNS query: 121.52.124.23
Source: unknown	TCP traffic detected without corresponding DNS query: 66.208.107.35
Source: unknown	TCP traffic detected without corresponding DNS query: 153.24.199.237
Source: unknown	TCP traffic detected without corresponding DNS query: 166.228.65.201
Source: unknown	TCP traffic detected without corresponding DNS query: 8.17.4.40
Source: unknown	TCP traffic detected without corresponding DNS query: 50.43.57.62
Source: unknown	TCP traffic detected without corresponding DNS query: 154.97.54.204
Source: unknown	TCP traffic detected without corresponding DNS query: 202.20.42.9
Source: unknown	TCP traffic detected without corresponding DNS query: 73.73.29.246
Source: unknown	TCP traffic detected without corresponding DNS query: 98.84.235.99
Source: unknown	TCP traffic detected without corresponding DNS query: 38.7.68.211
Source: unknown	TCP traffic detected without corresponding DNS query: 128.175.12.43
Source: unknown	TCP traffic detected without corresponding DNS query: 71.140.33.120
Source: unknown	TCP traffic detected without corresponding DNS query: 130.104.171.198
Source: unknown	TCP traffic detected without corresponding DNS query: 196.102.142.120
Source: unknown	TCP traffic detected without corresponding DNS query: 63.131.31.105
Source: unknown	TCP traffic detected without corresponding DNS query: 104.240.238.58
Source: unknown	TCP traffic detected without corresponding DNS query: 5.171.198.140

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: Xorg.0.log.151.dr, syslog.24.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.151.dr, syslog.24.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.24.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 135, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 348, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 661, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 671, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 683, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 684, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 725, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 791, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 940, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent to PID below 1000: pid: 941, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 135, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 348, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 661, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 671, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 683, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 684, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 725, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 940, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent to PID below 1000: pid: 941, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3762, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3763, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 5512, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 5536, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3762, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3763, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 5539, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 5542, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5819)	SIGKILL sent: pid: 5835, result: successful
Source: /usr/bin/dbus-daemon (PID: 5819)	SIGKILL sent: pid: 6058, result: successful
Source: /usr/bin/dbus-daemon (PID: 5819)	SIGKILL sent: pid: 6232, result: successful
Source: /usr/bin/dbus-daemon (PID: 5841)	SIGKILL sent: pid: 6215, result: successful

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3762, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 3763, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 5512, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5536)	SIGKILL sent: pid: 5536, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3760, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3761, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3762, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 3763, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 5539, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	SIGKILL sent: pid: 5542, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5819)	SIGKILL sent: pid: 5835, result: successful
Source: /usr/bin/dbus-daemon (PID: 5819)	SIGKILL sent: pid: 6058, result: successful
Source: /usr/bin/dbus-daemon (PID: 5819)	SIGKILL sent: pid: 6232, result: successful
Source: /usr/bin/dbus-daemon (PID: 5841)	SIGKILL sent: pid: 6215, result: successful

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/96@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5591)	File: /proc/5591/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5594)	File: /proc/5594/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5685)	File: /proc/5685/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5741)	File: /proc/5741/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5819)	File: /proc/5819/mounts
Source: /usr/bin/dbus-daemon (PID: 5841)	File: /proc/5841/mounts
Source: /usr/bin/gjs (PID: 6233)	File: /proc/6233/mounts
Source: /usr/bin/gnome-shell (PID: 5882)	File: /proc/5882/mounts
Source: /usr/bin/dbus-daemon (PID: 5736)	File: /proc/5736/mounts

Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/seats/.#seat0uX885f	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#127Sixrrg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#127yIwwQg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/seats/.#seat0PhkICh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#127iDUVyf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c1F1CVsh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#127F4V1Fg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/seats/.#seat0cqh8Ve	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#127IFZJBd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c1mUgEOd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c1Ze4Y4g	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#12752X3Kd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c17OMG8g	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c1nf6zDe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c16G4UWe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#1276vThSf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/seats/.#seat0KSB5wf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#1272MKyRh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/seats/.#seat03JEbje	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#1279Lil8g	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/seats/.#seat0lYi1if	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#127seMrxd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c2phYAzh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#127VV4kNe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/seats/.#seat0dHDHef	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c2mCwXjg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c2VoFVCf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/users/.#127yCK72g	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c2w4jJwf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c2gorHUf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c2mxWqQg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c2Pr9MZf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/sessions/.#c2hTmXwf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/inhibit/.#1WTTKwh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/inhibit/.#2ZhUHMe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/inhibit/.#3obreTd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5608)	File: /run/systemd/inhibit/.#4FlvpTf	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5668)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5764)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5764)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5799)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5842)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5882)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5882)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5882)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5882)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5882)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5882)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5882)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6055)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6055)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6255)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6255)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6259)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6259)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6260)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6260)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6262)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6262)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6283)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6283)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6067)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6067)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6229)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6304)	Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6487)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6487)	Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6546)	Directory: /var/lib/colord/.cache

Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6450/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5882/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5610/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5797/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6304/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6546/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6105/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6105/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6105/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5799/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6108/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6108/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6229/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6229/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5734/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5713/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/2946/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6706/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5591/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5591/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5592/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5592/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5592/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5790/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5790/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6067/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6223/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6487/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6266/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5730/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5730/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6261/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6283/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6260/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5904/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5608/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/1364/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5764/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5742/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5820/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6259/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5668/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/6558/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5591)	File opened: /proc/5705/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5542)	File opened: /proc/3762/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5677)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5680)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5682)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5686)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5688)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5692)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5694)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5696)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5811)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6056)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5727)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5679)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5681)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5683)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5687)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5691)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5693)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5695)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5697)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5729)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5699)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5672)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5705)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5705)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5593)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5593)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5676)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5799)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5676)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799)	Truncated file: /var/log/Xorg.pid-5799.log

Source: /usr/bin/pulseaudio (PID: 5592)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5699)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5799)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5842)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5882)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6105)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/na.elf (PID: 5533)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5592)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5593)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5672)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5676)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5730)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5742)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5790)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5797)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5799)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5836)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6216)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5820)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5821)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5842)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5852)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5882)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6055)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6255)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6259)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6260)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6264)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6283)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6105)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6226)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6229)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6304)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6706)	Queries kernel information via 'uname':

Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.448] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.116] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.270] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 176.854] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.817] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.068] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.401] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.482] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.838] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.607] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.638] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.180] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): DPI set to (96, 96)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.502] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.025] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.077] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.019] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.853] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.045] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.022] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.708] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.466] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.846] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.176] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.054] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.765] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.628] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.311] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.568] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.207] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.966] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.254] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.281] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.803] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.403] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.010] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.659] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 176.864] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.258] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.508] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.882] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.428] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.915] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.445] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.962] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.766] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: na.elf, 5536.1.00007ffdca114000.00007ffdca135000.rw-.sdmp	Binary or memory string: ARV/tmp/qemu-open.lf8ajM
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.910] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.843] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.812] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.742] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.087] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.213] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.993] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.874] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 172.853] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.122] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.324] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.094] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.379] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.548] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.961] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.367] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.110] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.771] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.077] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.814] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.772] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.830] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.391] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (WW) vmware(0): Disabling 3D support.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.229] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.430] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.014] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.945] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.700] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.026] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.354] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.118] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 172.875] (II) LoadModule: "vmware"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.670] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.115] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.375] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.259] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.301] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: na.elf, 5533.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5536.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5538.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5539.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5542.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5544.1.00007ffdca114000.00007ffdca135000.rw-.sdmp	Binary or memory string: VSx86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.745] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.787] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.900] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.942] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.384] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.937] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.491] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.603] (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.453] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.796] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.369] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.751] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.464] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.504] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.411] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.393] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.343] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.678] (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.936] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.357] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.514] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.559] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.191] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.969] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.714] (==) vmware(0): Using HW cursor
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.403] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.053] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.800] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.966] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.680] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.973] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.068] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.565] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.533] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.831] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 176.888] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: na.elf, 5542.1.00007ffdca114000.00007ffdca135000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.PZDETe
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.218] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.642] (--) vmware(0): w.grn: 8
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.166] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.474] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 176.873] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.445] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.411] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.555] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.825] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.207] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.539] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.695] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: na.elf, 5533.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5536.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5538.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5539.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5542.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5544.1.00005652447fd000.000056524492b000.rw-.sdmp	Binary or memory string: DRV!/etc/qemu-binfmt/arm
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.748] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.697] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.099] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.071] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.084] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.365] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.762] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.033] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.758] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.929] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.268] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.639] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.028] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.570] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.393] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 173.219] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.329] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.196] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.864] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.577] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.738] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.036] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.191] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.958] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.634] (--) vmware(0): w.red: 8
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Using HW cursor
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Backing store enabled
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.844] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.460] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.731] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.540] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.598] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.186] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.705] (==) vmware(0): Default visual is TrueColor
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.435] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.613] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.105] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.668] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.497] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.526] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.138] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.211] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.291] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 172.887] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.731] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.223] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.190] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.457] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.661] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.026] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.897] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.322] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.338] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.172] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.466] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.062] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.773] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.007] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.056] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.981] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.978] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.616] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.721] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.810] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.805] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.403] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: na.elf, 5542.1.00007ffdca114000.00007ffdca135000.rw-.sdmp	Binary or memory string: ARV/tmp/qemu-open.PZDETe
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.734] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.992] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.654] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.518] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.605] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.661] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.741] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: na.elf, 5533.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5536.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5538.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5539.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5542.1.00007ffdca114000.00007ffdca135000.rw-.sdmp, na.elf, 5544.1.00007ffdca114000.00007ffdca135000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.540] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.467] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.275] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.520] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.864] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.946] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.567] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.803] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.834] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.878] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.865] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.727] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.042] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.380] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.754] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 172.932] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.980] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.323] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.718] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.193] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.249] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.759] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.275] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.647] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.101] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.752] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.797] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.348] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.480] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.684] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.287] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.126] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.728] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.144] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.819] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.131] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.042] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.830] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.707] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.867] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.000] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.763] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.997] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.458] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.419] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 189.309] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.301] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.292] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.158] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.168] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: na.elf, 5536.1.00007ffdca114000.00007ffdca135000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.lf8ajM
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.698] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.625] (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.148] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.300] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.286] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:04 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.634] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.494] (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.743] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.691] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 181.139] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.418] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.058] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:11 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.125] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.088] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.204] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.854] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.890] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.858] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Default visual is TrueColor
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.786] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.795] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.420] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:55 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) LoadModule: "vmware"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.674] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.580] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.051] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.049] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.850] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.938] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.725] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (--) vmware(0): depth: 24
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.436] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.486] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:24:59 galassia /usr/lib/gdm3/gdm-x-session[5799]: (EE) vmware(0): Failed to open drm.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:10 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:02 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.014] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.779] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.062] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.605] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.098] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 173.083] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.239] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.311] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 188.208] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.736] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:03 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 178.313] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 177.501] (--) vmware(0): vram: 4194304
Source: na.elf, 5533.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5536.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5538.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5539.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5542.1.00005652447fd000.000056524492b000.rw-.sdmp, na.elf, 5544.1.00005652447fd000.000056524492b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:00 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.824] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 179.849] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:25:01 galassia /usr/lib/gdm3/gdm-x-session[5799]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 180.579] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5713)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5533, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5538, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5539, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5544, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5533, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5538, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5539, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5542, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5544, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5533, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5538, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5539, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5544, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5538.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5539.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5536.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5542.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5544.1.00007fb3dc017000.00007fb3dc027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5533, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5538, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5539, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5542, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5544, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	71%	ReversingLabs	Linux.Backdoor.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.24.dr	false	unknown
http://wiki.x.org	Xorg.0.log.151.dr, syslog.24.dr	false	unknown
http://www.ubuntu.com/support)	Xorg.0.log.151.dr, syslog.24.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
41.148.196.219	unknown	South Africa	5713	SAIX-NETZA	false
17.57.22.235	unknown	United States	714	APPLE-ENGINEERINGUS	false
178.60.249.95	unknown	Spain	12334	Galicia-SpainES	false
77.109.157.82	unknown	Switzerland	13030	INIT7CH	false
212.20.44.120	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
94.85.243.59	unknown	Italy	3269	ASN-IBSNAZIT	false
90.247.48.210	unknown	United Kingdom	5378	VodafoneGB	false
171.95.134.236	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
95.215.48.36	unknown	Ukraine	48882	OPTIMA-SHID-ASUA	false
194.144.71.98	unknown	Iceland	12969	VODAFONE_ICELANDIS	false
81.6.26.135	unknown	Switzerland	1836	GREENgreenchAGAutonomousSystemEU	false
142.92.161.138	unknown	Canada	818	DOC-ASCA	false
49.10.66.205	unknown	Korea Republic of	9858	KRNICNETKoreaInternetSecurityAgencyKR	false
116.133.62.126	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
37.35.209.238	unknown	Spain	12479	UNI2-ASES	false
148.56.211.24	unknown	Spain	12430	VODAFONE_ESES	false
75.79.174.91	unknown	United States	6498	INTRADO-CORPUS	false
38.96.119.2	unknown	United States	174	COGENT-174US	false
189.181.178.45	unknown	Mexico	8151	UninetSAdeCVMX	false
54.26.137.102	unknown	United States	14618	AMAZON-AESUS	false
141.1.252.120	unknown	Germany	1273	CWVodafoneGroupPLCEU	false
75.177.252.217	unknown	United States	11426	TWC-11426-CAROLINASUS	false
106.114.111.80	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
48.220.92.172	unknown	United States	2686	ATGS-MMD-ASUS	false
97.99.35.251	unknown	United States	11427	TWC-11427-TEXASUS	false
188.144.124.72	unknown	Germany	12389	ROSTELECOM-ASRU	false
41.108.48.173	unknown	Algeria	36947	ALGTEL-ASDZ	false
4.207.166.220	unknown	United States	3356	LEVEL3US	false
132.147.54.114	unknown	United States	11776	ATLANTICBB-JOHNSTOWNUS	false
46.111.236.27	unknown	Russian Federation	2854	ROSPRINT-ASRU	false
48.49.26.125	unknown	United States	2686	ATGS-MMD-ASUS	false
109.219.227.122	unknown	France	3215	FranceTelecom-OrangeFR	false
39.157.9.123	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
110.152.176.180	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
221.120.41.222	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
90.74.177.140	unknown	France	12479	UNI2-ASES	false
145.225.99.177	unknown	Germany	25039	ASN-LINDEKlosterhofstrasse1DE	false
170.234.84.201	unknown	United States	11685	HNBCOL-ASUS	false
77.198.164.103	unknown	France	15557	LDCOMNETFR	false
154.55.185.244	unknown	United States	174	COGENT-174US	false
70.66.252.68	unknown	Canada	6327	SHAWCA	false
199.119.115.238	unknown	United States	22925	ALLIED-TELECOMUS	false
122.208.229.28	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
146.181.14.108	unknown	United States	786	JANETJiscServicesLimitedGB	false
81.113.214.164	unknown	Italy	20959	TELECOM-ITALIA-DATA-COMIT	false
139.64.243.11	unknown	Reserved	62809	EXPOHLUS	false
92.154.45.111	unknown	France	3215	FranceTelecom-OrangeFR	false
20.67.73.45	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
67.241.131.123	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
87.248.145.178	unknown	Iran (ISLAMIC Republic Of)	47843	CWM-ASIR	false
49.105.53.152	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
175.146.218.189	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
206.163.104.103	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
52.22.221.201	unknown	United States	14618	AMAZON-AESUS	false
160.76.36.209	unknown	United States	36693	ALEGENT-HEALTH-1US	false
81.48.2.215	unknown	France	3215	FranceTelecom-OrangeFR	false
32.201.63.95	unknown	United States	2686	ATGS-MMD-ASUS	false
140.146.53.131	unknown	United States	46103	UWW-EDU-ASNUS	false
140.135.223.90	unknown	Taiwan; Republic of China (ROC)	1659	ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC	false
80.196.122.122	unknown	Denmark	3292	TDCTDCASDK	false
71.22.162.223	unknown	United States	7029	WINDSTREAMUS	false
49.200.247.241	unknown	India	55441	TTSLMEIS-AS-APTTSL-ISPDIVISIONIN	false
174.5.6.59	unknown	Canada	6327	SHAWCA	false
221.163.247.124	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
84.82.104.191	unknown	Netherlands	1136	KPNKPNNationalEU	false
180.68.127.138	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
173.139.22.69	unknown	United States	10507	SPCSUS	false
223.66.110.150	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
81.59.219.35	unknown	Belgium	13127	VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo	false
166.75.222.194	unknown	Chile	16629	CTCCORPSATELEFONICAEMPRESASCL	false
212.201.98.74	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
176.136.223.224	unknown	France	5410	BOUYGTEL-ISPFR	false
36.114.86.25	unknown	China	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
202.114.81.199	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
159.7.232.162	unknown	Sweden	1906	NORTHROP-GRUMMANUS	false
59.108.216.166	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
101.63.232.190	unknown	Italy	210278	SKYIT-BBIT	false
211.141.188.88	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
37.149.75.37	unknown	Cyprus	31549	RASANAIR	false
89.206.103.220	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
142.220.72.254	unknown	Canada	13576	SDNW-13576US	false
196.233.130.48	unknown	Tunisia	37492	ORANGE-TN	false
165.204.55.254	unknown	United States	33619	AMD-MARKHAMUS	false
155.154.166.83	unknown	United States	1488	DNIC-ASBLK-01488-01489US	false
4.131.82.80	unknown	United States	3356	LEVEL3US	false
61.235.149.98	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
83.118.208.212	unknown	France	34177	CELESTE-ASCELESTE-InternetservicesproviderFR	false
126.139.28.45	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
69.233.21.178	unknown	United States	7018	ATT-INTERNET4US	false
113.236.166.136	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
172.147.112.158	unknown	United States	7018	ATT-INTERNET4US	false
137.61.4.24	unknown	Sweden	15991	SWEDISH_TAX_AGENCYIT-departmentKortagatan10SE-17194Sol	false
128.153.194.132	unknown	United States	92	CLARKSON-ASUS	false
85.43.219.86	unknown	Italy	3269	ASN-IBSNAZIT	false
184.226.66.6	unknown	United States	10507	SPCSUS	false
153.196.225.114	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
69.222.230.189	unknown	United States	7018	ATT-INTERNET4US	false
161.153.47.58	unknown	United States	9328	DATACOM-AUDATACOMSYSTEMSAUPTYLTDAU	false
46.204.222.204	unknown	Poland	12912	TMPL	false
190.20.195.197	unknown	Chile	7418	TELEFONICACHILESACL	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.148.196.219	k8k3wa3PQS.elf	Get hash	malicious	Mirai	Browse
	Nwa5mF4VYK.elf	Get hash	malicious	Mirai	Browse
	wVpFI3C2ND.elf	Get hash	malicious	Mirai	Browse
	JElECSUJ87	Get hash	malicious	Mirai	Browse
	Yhy1iNn3Z5	Get hash	malicious	Unknown	Browse
	7g5SmEJaZ7	Get hash	malicious	Mirai	Browse
	6HMlwTE4ku	Get hash	malicious	Mirai	Browse
95.215.48.36	jade.mips.elf	Get hash	malicious	Mirai	Browse
	qynd1m1ejo.elf	Get hash	malicious	Mirai	Browse
	hocku3bllE	Get hash	malicious	Mirai	Browse
81.6.26.135	apep.x86	Get hash	malicious	Unknown	Browse
49.10.66.205	87W4z6rKEU	Get hash	malicious	Gafgyt, Mirai	Browse
116.133.62.126	miori.x86-20220703-2150	Get hash	malicious	Mirai	Browse
116.133.62.126	x7bluEAnaL	Get hash	malicious	Mirai	Browse
212.20.44.120	200PU7wVmo.elf	Get hash	malicious	Mirai	Browse
94.85.243.59	H75pA6RLa6.elf	Get hash	malicious	Unknown	Browse
	WcBiG77v2j.elf	Get hash	malicious	Mirai	Browse
	3Ik3qpZS8V	Get hash	malicious	Mirai	Browse
90.247.48.210	arm7.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-mirai.kro.kr	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
byte-mirai.kro.kr	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INIT7CH	na.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
SAIX-NETZA	na.elf	Get hash	malicious	Mirai	Browse	41.149.186.128
	na.elf	Get hash	malicious	Mirai	Browse	41.149.186.165
	na.elf	Get hash	malicious	Mirai	Browse	41.145.255.147
	na.elf	Get hash	malicious	Mirai	Browse	41.149.186.144
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	41.148.201.120
	na.elf	Get hash	malicious	Mirai	Browse	41.149.186.177
	na.elf	Get hash	malicious	Mirai	Browse	41.151.178.150
	6BTZGMvUv1.elf	Get hash	malicious	Unknown	Browse	102.249.160.122
	yakov.m68k.elf	Get hash	malicious	Mirai	Browse	41.147.11.12
	yakov.mpsl.elf	Get hash	malicious	Mirai	Browse	102.248.170.220
Galicia-SpainES	novo.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	77.26.95.147
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	77.27.124.1
	ExeFile (323).exe	Get hash	malicious	Emotet	Browse	213.60.96.117
	ExeFile (367).exe	Get hash	malicious	Emotet	Browse	213.60.96.117
	ExeFile (384).exe	Get hash	malicious	Emotet	Browse	213.60.96.117
	ExeFile (124).exe	Get hash	malicious	Emotet	Browse	213.60.96.117
	b3astmode.arm7.elf	Get hash	malicious	Mirai	Browse	83.165.134.243
	77.90.35.9-skid.arm5-2024-07-30T07_10_52.elf	Get hash	malicious	Mirai, Moobot	Browse	77.27.186.148
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	178.60.215.155

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5746/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5749/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5751/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5753/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5755/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5757/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5760/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5836/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5864/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5869/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5871/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5873/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5875/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5877/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5880/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6059/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6216/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6233/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6452/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:/v:n
MD5:	AB48E6C7FBD7E8A068985FA4755BD3E2
SHA1:	79A816E5EE1E7139D7CD4326A713C16C16DBE236
SHA-256:	D6A1C3C3BEDDD217D2B363A0AB8F323F9DF3CF60121E37D6C708541EBEE483E6
SHA-512:	F7EC00188D55C3C62C464F5C498AE061931475E8416B50761C6229B0D84CC45730D18CFB8FAC64FA89D682558078CD6D406F7147091C5D398A2B8E56512C789B
Malicious:	false
Preview:	6226.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:HV6n:16
MD5:	0B429C94094E10A38EB08EFEF19A9F47
SHA1:	FC3A7BE075FE394426D5FAD4DCB694938468A1D9
SHA-256:	60C22306D28AA8E11624D024837073220E2BE562FB02764897B0E20BC7888459
SHA-512:	34DFBE55BF624D5DA51833254BCC26A69CB7E208FF5EC56ED000DC688767BDC0D66E86FB0F2941CC6C0AC9CFF67D424964633A6C107E74F93F41CACEB59981FF
Malicious:	false
Preview:	5705.

/run/systemd/inhibit/.#1WTTKwh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifqyAIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfYApLHK7wR9n
MD5:	AAC5D869047B22D01B0697C8CF9F1F7C
SHA1:	07E370C072C8D09EEAC168DF8DB8375CF1592ACA
SHA-256:	520666D2F02958C2AA994743883588545DE847B85A2D1C2499EA3C35F6ECEB4B
SHA-512:	1D47F4F283F1B50D538AC204B2D72CDCD3ECC10B11747C15EE16CBF6298631C1101BF5C61D50CC5048B6344B99A12B9B59D0A73DE190BA833BE82F87A84DF415
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6067.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2ZhUHMe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.19157450891941
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+MqKLXv0Rsz:qgFqXQXTI1IlNqKjcRsz
MD5:	3C065E5D38BCEDBC3D1B7828E9F3A5EC
SHA1:	14AF6FDD0F3B2DA29C64F37F30AE88E4F7938EAE
SHA-256:	2039EDF854601905D14F4338F534340D9C2ABC850C0A2A669861910778A1FDBF
SHA-512:	F408908FAF681CA8F166CC4C441B118303141385B3185E738E0AC8DDBAF2EE14AF99FEA1806CA390EB72AD3AD7FF659C60F72AB34E107305EB2B79FF78B20515
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6266.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3obreTd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.148187060462055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++h3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+MqKLXv0RT
MD5:	12DE7F20F1E9ADB96898C41521BBBA10
SHA1:	945634F714B7D202952F61CB1E7D9FE4DD5DCD0C
SHA-256:	E2CFBCDDB34F4B9ECDD457885B643B3BC46AE9D4980F8433DCD62B9647CAC289
SHA-512:	386849357157759EE768528A0B29BE769645FD2CE50F15087BE29DD4F7C0809D0A689F5C5864717CD31CA21B4C02C0A29537B4D9562928FFF60252EAD4615B3F
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6266.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4FlvpTf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.165199761184817
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++ltqY4iXulpv5RX8/SflY:SbFuFyL8OAAx+uYDlpLRS
MD5:	7A4F0C10F55897E21B37221B17541745
SHA1:	ABFA171F7C872A298E8B2D055F1DF39E246B5DAE
SHA-256:	67EB16832D6A702C7EFA3633FBC721A574AE21883A6801F32D87822FB0D51FE9
SHA-512:	E5AC8BE6123E2D8C9229AD0414E203A4EC64B78C0E089321BC7CEA0F33700AF65E75142DC86A9CB534C047FBF14505209E3FDC37C54374903227357BFFF3D17A
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6283.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/seats/.#seat03JEbje

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0KSB5wf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0PhkICh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0cqh8Ve

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0dHDHef

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0lYi1if

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0uX885f

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/sessions/.#c16G4UWe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.391727939529079
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GB2g9y2qYS4:qgFqPuFdDJIi9x2xayW2gN/
MD5:	AA25537E6BEFA7C4AC718A7F49B08E36
SHA1:	34E95ADDD08AAE2A922D4932731CB2CD72FEB55B
SHA-256:	D018724215D53E7C1CAB0B5F0817BBC47F437855244865082EB17B287C85FF76
SHA-512:	FE9D4AEB0E3325477CC423D8D375892AB4FF0AA9572054238F2B8498BB464EA369C9E07607631539B39837B43550D457766B7D9903D3EBCD7EA5F92669CCDE6A
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5730.REALTIME=1728246278731895.MONOTONIC=156133326.

/run/systemd/sessions/.#c17OMG8g

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.443120849736617
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB2g9y2qYS+rX:qgFqPuFN6IG0n99x2xayW2gNxX
MD5:	F1029D259A6D8C37008EAD0E0517512B
SHA1:	586B6EE58618CFCDA9A4CEEE3248AB1386B7F01C
SHA-256:	24C143AF2D0B242C8F3DD50555AC6422E3257799D94407C1A7070DB412262D34
SHA-512:	C963880161D78DF7EAF31E3DEA45CA41B1488D11A3A98DC176863822E723D675544E83FD41CAADC51AC3596936782611C81ED315BEF4D791A8628A0448C78BB0
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5730.REALTIME=1728246278731895.MONOTONIC=156133326.CONTROLLER=:1.15.

/run/systemd/sessions/.#c1F1CVsh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.489731670954465
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffCkHxfx2xNIByy6GB2g9y2qYS4:qgFqPuFVuRZI4B79x2xayW2gN/
MD5:	ED9CC50D7952913D321FDDED0BC46761
SHA1:	FF67BEF74BE900FC5288C0ECA7389C02DEE0C3BB
SHA-256:	2211A64E710C7F855BB44A6E3B4464F09CE3170E5BCB9404AD6D39E68A8EB34D
SHA-512:	B8F99DD15DE445BEA585B96B63576531A729F502962A5C37114B2EB105797597D860ADF0B505267966D3294D792C95B856F5692E6D9FEFB9B2D7EA30A1367A98
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7875.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5730.REALTIME=1728246278731895.MONOTONIC=156133326.

/run/systemd/sessions/.#c1Ze4Y4g

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.433684325791191
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB2g9y2qYS4:qgFqPuFN6IG0n99x2xayW2gN/
MD5:	82CB0E55564E33077BDC1A9FB47B160A
SHA1:	042662B5DF020BB006ED1D35CB2E469D11B35AF3
SHA-256:	36CDA1794EE63CAD8ED2C1CBA04057C5DFC68A3BF25276A1854FD58124CBDD87
SHA-512:	2632F223AA30A74235990180820D702D5D137257CBE3AFA2A9BF44E560812E70498FD7B5CB68C3D3CF0056BCD575922A66E3C57999F8818651B1AF38A271A005
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5730.REALTIME=1728246278731895.MONOTONIC=156133326.

/run/systemd/sessions/.#c1mUgEOd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.433684325791191
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB2g9y2qYS4:qgFqPuFN6IG0n99x2xayW2gN/
MD5:	82CB0E55564E33077BDC1A9FB47B160A
SHA1:	042662B5DF020BB006ED1D35CB2E469D11B35AF3
SHA-256:	36CDA1794EE63CAD8ED2C1CBA04057C5DFC68A3BF25276A1854FD58124CBDD87
SHA-512:	2632F223AA30A74235990180820D702D5D137257CBE3AFA2A9BF44E560812E70498FD7B5CB68C3D3CF0056BCD575922A66E3C57999F8818651B1AF38A271A005
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5730.REALTIME=1728246278731895.MONOTONIC=156133326.

/run/systemd/sessions/.#c1nf6zDe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.433684325791191
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB2g9y2qYS4:qgFqPuFN6IG0n99x2xayW2gN/
MD5:	82CB0E55564E33077BDC1A9FB47B160A
SHA1:	042662B5DF020BB006ED1D35CB2E469D11B35AF3
SHA-256:	36CDA1794EE63CAD8ED2C1CBA04057C5DFC68A3BF25276A1854FD58124CBDD87
SHA-512:	2632F223AA30A74235990180820D702D5D137257CBE3AFA2A9BF44E560812E70498FD7B5CB68C3D3CF0056BCD575922A66E3C57999F8818651B1AF38A271A005
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5730.REALTIME=1728246278731895.MONOTONIC=156133326.

/run/systemd/sessions/.#c2Pr9MZf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.463245768860784
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBSTgFBDqO9kdn:qgFqPuFNuCH0nI9x2xayWwgFB+O2d
MD5:	6C926DF0ABBF21F0CAA59E86D78A898C
SHA1:	138E9424CDC2E2ECD6567AC83D6FF2C6D21F6D8F
SHA-256:	51E66B972F874120626EA33CD93A770A90B7EE1A29B0D2D23589179421D57864
SHA-512:	A82963216D2BA9B4EB97D1EDF4523ACBBE25822343614D3B7BAD326D32A4975B9FC655CB3CD60CFA7A8A1270853B82CE4ABE5C5AFF7A583D2C35AEC44A289B70
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5790.REALTIME=1728246289663986.MONOTONIC=167065416.CONTROLLER=:1.19.DEVICES=13:64 13:67 13:65 .

/run/systemd/sessions/.#c2VoFVCf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.429959979591181
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBSTgFBDqOK:qgFqPuFNuCH0nI9x2xayWwgFB+OK
MD5:	EF6BB4D2C4FD0384BAB2985EE91E3B47
SHA1:	FA48415351057ED524D3168C3250E5936E3546BB
SHA-256:	782BBC15C685B04FC68D9FCB712F446D3460377A144D54318EAE3BE37E03F230
SHA-512:	8F2ED71861B65ECD0C49C9172EFA140F3B217CE1419C657D97E4EF030EBAC5186075E350DEB4659847E915819B738BA2D13AB60A99635FAFFBB0EACDDF4F1AB2
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5790.REALTIME=1728246289663986.MONOTONIC=167065416.

/run/systemd/sessions/.#c2gorHUf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.445733055221448
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBSTgFBDqO9kn:qgFqPuFNuCH0nI9x2xayWwgFB+O2n
MD5:	52C14BB8849A512872BE255AF76453A2
SHA1:	D9AC3DDA8BC7F6C3EB1D1E9A4B663C979647AAEA
SHA-256:	1E6DF60CED6CB660EB533FE13658C8FAE77763E44890596EE597BA4123D47F41
SHA-512:	497FFFA77560DA0844834C6A0B06D9BE12F540041D34912CA20FB390E755A1C583FE24B5CF0609EB6DFECD575EB9B8F3CD3FF93488BC8C45F7CC0A48E93D4312
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5790.REALTIME=1728246289663986.MONOTONIC=167065416.CONTROLLER=:1.19.DEVICES=13:64 .

/run/systemd/sessions/.#c2hTmXwf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.462353963801828
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBSTgFBDqO9kbn:qgFqPuFNuCH0nI9x2xayWwgFB+O2b
MD5:	CBD968B855046DEA348B2C176A733ED5
SHA1:	248B31E98F5F91CD16C0B8522723F92051C2F329
SHA-256:	7580713C9A13CFB004C33B90AB9E2A4DD1F8FBCC72559ED143B62E6C91C7F73F
SHA-512:	EB4E8BE5B8F8FD696AD81D2CA203EAF0F3B87DAAA193C877BAC9DE901C3430ACE55240220A471C2697E9C2E9126E8A21520F35D9F5266F933B0CE6B606EB71A0
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5790.REALTIME=1728246289663986.MONOTONIC=167065416.CONTROLLER=:1.19.DEVICES=13:64 13:67 13:66 13:65 .

/run/systemd/sessions/.#c2mCwXjg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.429959979591181
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBSTgFBDqOK:qgFqPuFNuCH0nI9x2xayWwgFB+OK
MD5:	EF6BB4D2C4FD0384BAB2985EE91E3B47
SHA1:	FA48415351057ED524D3168C3250E5936E3546BB
SHA-256:	782BBC15C685B04FC68D9FCB712F446D3460377A144D54318EAE3BE37E03F230
SHA-512:	8F2ED71861B65ECD0C49C9172EFA140F3B217CE1419C657D97E4EF030EBAC5186075E350DEB4659847E915819B738BA2D13AB60A99635FAFFBB0EACDDF4F1AB2
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5790.REALTIME=1728246289663986.MONOTONIC=167065416.

/run/systemd/sessions/.#c2mxWqQg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.457613876982729
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBSTgFBDqO9ken:qgFqPuFNuCH0nI9x2xayWwgFB+O2e
MD5:	809DF08E7172F78EFECF71037A33A9F4
SHA1:	A6A8B1597C7E8643846577A13F64F5431D2915E5
SHA-256:	CD9CEED9C5884CA7F7DB9F46C0AA0E7D555E45EE4447023A637791C6CAB6239B
SHA-512:	F66B1A548CE3491135C6AE0F748DC4C5C11148D4D454822504D8D38276C796B6864A4A040FBA7C88F6B6E36A79F7546A36E0F6AC2151A1AA5D0080EBB4BDE710
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5790.REALTIME=1728246289663986.MONOTONIC=167065416.CONTROLLER=:1.19.DEVICES=13:64 13:65 .

/run/systemd/sessions/.#c2phYAzh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.490574815683708
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xfftBxfx2xNIByy6GBSTgFBDqOK:qgFqPuFVuRpCvBFB9x2xayWwgFB+OK
MD5:	9A165705223BD4127AAC517694E78B82
SHA1:	4CBBF061FD1940C67FB2F03A6382C0FF59B642E1
SHA-256:	83963FB3982E2C115D88192890839629B53C6FCCFAC346A7F6280946BDFC59F5
SHA-512:	7C24F8F527AD4488691B814A8150407CA560AAC5ED8CAD076CC5C9C0C986F600C2B2E939D287E676A231350316670CF8D9AED39350CE7E6AA4E277C4F6298549
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7938.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5790.REALTIME=1728246289663986.MONOTONIC=167065416.

/run/systemd/sessions/.#c2w4jJwf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.439555594815788
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBSTgFBDqO9kF:qgFqPuFNuCH0nI9x2xayWwgFB+O2F
MD5:	7C05E1304AA00A92B08DA5755FB7BB88
SHA1:	CD58C2B4DAD7DAAE2D0ED57F0A444506D1E9E34A
SHA-256:	E35E60BC5D6754736F47D0F829644AEE0C0C49B87C870ACCD5AFDA64F7B08923
SHA-512:	F7F7EA6E204889F762B6EAD9B50103E0C6EF0BA06D602B6C8F1B3C85EA2047646B8F8D83D93A51C94AFB6CB6FE2668A6F447725AB81228F2EDCC77F76AFE73A8
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5790.REALTIME=1728246289663986.MONOTONIC=167065416.CONTROLLER=:1.19.

/run/systemd/users/.#1272MKyRh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.162475639197508
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfg9RgoqrqB9j2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegbYrqqthQHtPnmDq9x
MD5:	9FE7B9247559E41F9F01DA00D95174C4
SHA1:	3E4D74CD04B5FACD4C7917A2959A95B9653D8665
SHA-256:	1D67FC25E2DBCB1C28D61C8A449D90E915D0967A2BE805F8E0A51203D95FE6D7
SHA-512:	C4A237F3A582D1553788B32E2B456D804EB149E8133CF1534ED8FEE54D952A036062D77177B3E1E6D6CE38D88BA7060F68F9220D25D73F57F5A0B144B8E6F519
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#12752X3Kd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.162829544408925
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfg9RgoqrqB9j2thQc2x9sS02/g2owB:qgFq30NzL/ixegbYrqqthQHxbPYA
MD5:	EDED34C202E0D797830BC65F308A4D5A
SHA1:	E68B85D8278FC13DBE9064D1189861635982D107
SHA-256:	AE8A859130004980E10F2ABAE93D38A05BF5ED6A36847D4110D09E5C52A7C54C
SHA-512:	9DCB744A24A9F9C7E5E22EBDA801510768868105B4628955490EE4DEB0F1F26A5EE7DB4844EC7D481F9DBC119D1F6B33A992967744096CECC2570B80626449E6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1276vThSf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.178677694442569
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfg9RgoqrqB9j2thQc2x9sS02nmD2owC:qgFq30dAL/ixegbYrqqthQHxbPnmDd
MD5:	3A6AC213080FE3C8A914C498DB839120
SHA1:	30BA3AD90831779FD6A704A4AF18779EFF44E6C4
SHA-256:	514B6CAD932A0BDF26B61A96A374022B6B33CE36608DE66604FA10737D25986E
SHA-512:	800EE653B67D611D8EF2C9051AB2D1894C19F0680730DCEC00764696C7681B30ACF724027990BA2DFF67082A459D2AD7864B65B5B4D17AF6C79F73AFCAACEE1F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#1279Lil8g

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.162475639197508
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfg9RgoqrqB9j2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegbYrqqthQHtPnmDq9x
MD5:	9FE7B9247559E41F9F01DA00D95174C4
SHA1:	3E4D74CD04B5FACD4C7917A2959A95B9653D8665
SHA-256:	1D67FC25E2DBCB1C28D61C8A449D90E915D0967A2BE805F8E0A51203D95FE6D7
SHA-512:	C4A237F3A582D1553788B32E2B456D804EB149E8133CF1534ED8FEE54D952A036062D77177B3E1E6D6CE38D88BA7060F68F9220D25D73F57F5A0B144B8E6F519
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127F4V1Fg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.333152441395944
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffCYfg9RgoqrqB9j2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBLgbYrqqthQHxbPYA
MD5:	6A9C0B22B6D2E00D2B7A142143CC9CDD
SHA1:	B579A2DD2502EAF05B5DB6C60EF3ECD01E8D9EC3
SHA-256:	20477D9121EC1D4D7BAD70ABDF64502509834E390CDE17C458BDF266D29305AC
SHA-512:	DDB51493C9FA1728F66449F6A06A41E51C8AB5231BE40685E05EE8A19F804337667CFF21D47CEB980583E957774D66781A49E929F142EC6CE05AD74A67884822
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7813.DISPLAY=c1.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127IFZJBd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.178765799389006
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfg9RgoqrqB9j2thQc2x9sS02/g2owB:qgFq30z1cL/ixegbYrqqthQHxbPYA
MD5:	E0F2E41C51C1F4FBD8D14C6B0F3E2B5D
SHA1:	007A01155047C9F1E12BE86B5C9CD579D62A9C89
SHA-256:	34484B9676DF760F8E69A4FE6AD577372476FD040EBEE817D78590731B3A7509
SHA-512:	FCC7528A0A6F278586BFCDEB04BFE0E74D6B8E39C3275F31B51E8EC75A0B405FC1F6364A40302E56574C514C36D16BF97357A1442F2688AFDFF0EBC86337FD59
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Sixrrg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127VV4kNe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.178765799389005
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTg9RgoqrqB9j2z5c2zw02zb2owB:qgFq30z1cL/ixxTgbYrqqz5HzwPzbA
MD5:	CA075248A7A7C6F2375EE5D8DCCE8B6F
SHA1:	94653497DD1EF6ED6BA5A0F70D4579412DD13804
SHA-256:	4006DD7D02E9D176F73FB942CC982B311126D8E36195312E2F4150253DAD8064
SHA-512:	28C5039B6CB2C1059F1BE3BE448EDE37588638112FF917C6778046D475871F12479B876D2A7D3E40B6DF30D183F0703BF31A0B9E66DCFDAE80DCA32719D19F69
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127iDUVyf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.314206638581218
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffC7g9RgoqrqB9j2thQc2x9sS02/g2owB:qgFq30VuR8L/ibB+gbYrqqthQHxbPYA
MD5:	0D7DCC951A6993F5A2074F60F319B3E6
SHA1:	C725793D97E04657F973AE7F0FF1A83DE6254B8C
SHA-256:	38D9B518859366ABFC7102596797DD90BB5B6D36F2C9E955F6D024562D5C6E08
SHA-512:	2AC6E6E2E7AB81F5B214EB686BBA48824DAF1996CCECDA3B3F89F1B68C35DE5108200E7C0F789B5DD9ECF6490C4E5E9EC45316702F56CD9B6C13820F6400EE80
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7813.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127seMrxd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.157661686216078
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJg9RgoqrqB9j2z5c2zw02zb2owB:qgFq30z1cL/iRJgbYrqqz5HzwPzbA
MD5:	9E2503458360A27BBE80F33FDBC30947
SHA1:	ABAD661F5835D1F093468CEEF227D70939DA6E85
SHA-256:	34CF8111F3C29140473EB91CB464C21EE065483BE743FD3B77FC6676C58DF19D
SHA-512:	B076950F63DE77C4FC5047E9D4C0B6573B6BA880CD43FF4D1EFAFC0D6BC84E75685131CA42957D5CB6666EA9FDCAA73C1B853C6E75E08D1654DFFD3EFFE4BC9B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127yCK72g

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.1628295444089245
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTg9RgoqrqB9j2z5c2zw02zb2owB:qgFq30NzL/ixxTgbYrqqz5HzwPzbA
MD5:	FA6534516542EF09D3722556D1193432
SHA1:	B5D74522D8244095AAD01EADC83ECA138025438C
SHA-256:	246E33F7017A5741430A84ED184DEF10C3D48F9C99C6E6B95D095649B75803D5
SHA-512:	428D4B8F0CE44D7CF0B3AD0C8916C768A31F6016C493AAE270AEEFF17563512FA0CEC95DEDE4B86A7E3CC987A014244F6A8BCDDAA53AB99B65D8188F8A3F8EF9
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127yIwwQg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.309149040137966
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffC7g9RgoqrqB9j2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gbYrqqthQHtPYq9M
MD5:	B86FBE9A925FF6C17CEC5C04566CE783
SHA1:	09234B9E8320F71D91F5E31DE9DC0F094E24BC9A
SHA-256:	621FCF79250100161E841975E373F224E988DF77F3161364C100A33D7AD59922
SHA-512:	F2C4611511EA45E60089E60E551A22235ACB305583FFCB83FCE0BC108B1198DDA7C1BC8827A26462678244EC01DF564624BFB4B802E68FB91B54E139184553FB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7813.REALTIME=1728246278684489.MONOTONIC=156085919.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Fc/:q
MD5:	2E83C1D539906E96D97F8B1EC1184FC4
SHA1:	AE4054E23301ED7F5BFDD2C0D7FE9938BA4E2641
SHA-256:	1C7F12284169E4E6E0976F769BE222EDACB8D47A5CDD3BC0C7CD56F852FE98E2
SHA-512:	0F3B9712466BEF81EEC72C8E5E74232FC5A337C6E1EDE1DE721852F311175D81AF8D702498680A769481F98E3A8C6C81E7422AAE1982456C29F5CBEB2E1F3D9F
Malicious:	false
Preview:	5592.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.007085991779652
Encrypted:	false
SSDEEP:	12:OxP1g9iveY+1mXxPHuFeU5veY+HurklBmxPDQXwveY+D44xPUBKiveY+U3BQZ0vp:x9SEe3lfXIr86BPav1k+1opDB
MD5:	EB7C77B69EC2220B7598E6E2D25D60D6
SHA1:	49F63BBF393B27E0FA1E5620127EE1405BF8AA66
SHA-256:	2E025A8496E9EEBFDCD5146F81903A4F4152AC3BAC757ECB9D6188D1F2E114FB
SHA-512:	96DD8DCD1FC20AACE3B4F26A09DFC012683B434D326D5DA51DB5817D54C5CF3E1B301B5067BFF48D1443F9670F17C62539422DD0B5E3CA7BC3B6C4EFE3E8BE82
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5820..MIT-MAGIC-COOKIE-1..7...Q...Z......XSMP...#local/galassia:@/tmp/.ICE-unix/5820..MIT-MAGIC-COOKIE-1..P;.7.....{ng`.c..ICE...!unix/galassia:/tmp/.ICE-unix/5742..MIT-MAGIC-COOKIE-1.......0s./..q.v....ICE...#local/galassia:@/tmp/.ICE-unix/5742..MIT-MAGIC-COOKIE-1....q9#.J....\|!;S..XSMP...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1.....w.0......F!W...XSMP...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1......,mN..b7.....ICE...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....]v1..".?.}.....ICE...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1...o4...6]..c..f....XSMP...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1..N.#r......S.....XSMP...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....q.p.."LS.DM(..ICE...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...]...,0..2...`..ICE...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...y.&.O...j../I....XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.968777719849575
Encrypted:	false
SSDEEP:	3:rg/WFllasO93vdv0DaOWFllasO93vdv0Dn:rg/WFl2/dcGOWFl2/dcD
MD5:	04DBE40F0A648915E5724CD885CE66F3
SHA1:	88162A68EDA440D6BD3BD0C10BFDA381171061A1
SHA-256:	A0DF2A78FDDA87F1C14BB0875BEA2CF6E5957F478E1909EB6B27D3A64D5DD7D1
SHA-512:	A5FC18D348EB88766643F918FA7EAFF41BD219BD137228D3F7454D9F84EABC5DD057466EFB6141817813D0E307557BDAD35761E96096519623D7561587FBD2FF
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1....>H....s...~....galassia....MIT-MAGIC-COOKIE-1....>H....s...~

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:4Qv:4Qv
MD5:	E6DF9600D6455C0F73529B7794FE3DEB
SHA1:	BB6B5A07689A01B0E1EF023BEEEF8DF2FB3A89CB
SHA-256:	AB1B0E614946D89128C9EB03F7AC53D10B4FCA1FBCB16865BE7579B3A46641C9
SHA-512:	337C62FD98A626C4413E2A277A2B1822674D21000F78D9C104BF43F87B0FCC63CF867131CC56B0A1B56F7B5049C7E3CA65259A60C0CCBFB7C96B928F072EE68C
Malicious:	false
Preview:	6105.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018082
Encrypted:	false
SSDEEP:	3:PCsXlXEWtl/7w1blt:3+ylE1bl
MD5:	DC5285C3BD9AE2C6179BCFEE5E028C95
SHA1:	58DACA1C3E7F82A5CF583D70D8F406A472A81355
SHA-256:	761BD536DD3EB379EC5144AFC776FF1C3D5A6B648D282F677C0A4F1A61E8B3EC
SHA-512:	5531A3778DD4245F4C90599DF15870B65E8EFA4394DD9E20115B6391A25B8CFD6ED80584890DB0634BF3369C37C4EBD3249C4AF93479F0A46835D24DA712186E
Malicious:	false
Preview:	....(...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................(......g.P......................................

/tmp/qemu-open.PZDETe (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/qemu-open.lf8ajM (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.0B08U2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.YJLCV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.126639902819498
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWZzp3Ivn41r:q5sU3LWfLUDmQymqSFbfomSZY4fN
MD5:	A17CC8C782395DDEEC4B3FAA64DC67FB
SHA1:	271DB3E32B32DB0AF999CDD63948287C1D3F6584
SHA-256:	1CC0C7F7774730A3A804CDF6015A71DB22FBB6A49F0316A863D4C276BED62C03
SHA-512:	4380082A461C32BF7C0A5E798BCDACBE5A78DDA9B8157DBE134370B2012F29E81D2861EB7814A48F395B536AE75A830A66808434054812BBD4665C7FC5EDB35E
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-Jg7eEnf2,guid=9b2a182c09db247ae12b57ef6702f241.IBUS_DAEMON_PID=5940.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.285420176187545
Encrypted:	false
SSDEEP:	384:LJGivYwzrVyMbdjdedzdVdfdtdtdGdYdpdBd+dwdodWdTdodIdndpdIUPdY3dOx+:L8iAO3FwC+Zkmc9BcH8L7+If
MD5:	EE8966ABE47515D99DDB57D633F388FF
SHA1:	3A57965BDC3FE19FBD7FCB903C973BDD02DE638A
SHA-256:	F9779D1C2B74745515C874B392D4462EB7A688AAB1E301F289605A154459532E
SHA-512:	37FAAB3FE95A0AE02A1837D1B1EE8318C86AC3A669811519A1A6D7A2A9707145FEB4C43227B11DA3620C0DF9284223B6BE5A5C0B84FDE5900BEE627FD6627D81
Malicious:	false
Preview:	[ 168.280] (--) Log file renamed from "/var/log/Xorg.pid-5799.log" to "/var/log/Xorg.0.log".[ 168.305] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 168.324] Build Operating System: linux Ubuntu.[ 168.333] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 168.341] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 168.378] Build Date: 06 July 2021 10:17:51AM.[ 168.384] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 168.392] Current version of pixman: 0.38.4.[ 168.399] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 168.405] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.982115507101219
Encrypted:	false
SSDEEP:	24:xDZ4PDZegJ0VuVtqnI6AvV6A2+VblfqH77NcIEIkerCQiVOE8FdLP8ofdcXju6NM:n8vtfV43vrCvpKQOurboi3rCn
MD5:	F6196B16B057CAC84A6A01A7175CE278
SHA1:	1AE74181BD7D713C3DBA7BC02CB31AB9C910A2AC
SHA-256:	2B28FA4AD4C3AA636EA7E6274A9B61C85D1DE71D30C33172505B3DD1B928F710
SHA-512:	A90DD78A0F49D4B5DC3D30FF4F5C8E032560AE719BF4AC690BB9DAAED7BB45B5C497273EFC1D85CC744DA52C816FD444DD210E9A56A318864604EA14FE6C825D
Malicious:	false
Preview:	Oct 6 15:24:16 galassia systemd-logind[5608]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 6 15:24:16 galassia systemd-logind[5608]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 6 15:24:16 galassia systemd-logind[5608]: User enumeration failed: Invalid argument.Oct 6 15:24:16 galassia systemd-logind[5608]: User of session c2 not known..Oct 6 15:24:16 galassia systemd-logind[5608]: User of session 2 not known..Oct 6 15:24:16 galassia systemd-logind[5608]: Session enumeration failed: No such file or directory.Oct 6 15:24:16 galassia systemd-logind[5608]: Watching system buttons on /dev/input/event0 (Power Button).Oct 6 15:24:16 galassia systemd-logind[5608]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Oct 6 15:24:16 galassia systemd-logind[5608]: New seat seat0..Oct 6 15:24:16 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Oct 6 15:24:16 ga

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	41074
Entropy (8bit):	4.706730806922234
Encrypted:	false
SSDEEP:	384:8O0J06LVLKvHuK0Vp5u27k9dPInIkINIswIBIMMI+piaxs3wUjSn8W4fvmVGfIhv:V0J06LVLKvHb0Vp5u27k9H6I+7GfIhl5
MD5:	E976FBE8F2A8FDD430510E698B03D67D
SHA1:	A19D7D18B05D6B08A8536F9FCE352A1FA453CF8D
SHA-256:	6D71D6748E2B712DA96C312A52E5A37D6D9DEFCB0F2EC5EA339D2C42F2920B67
SHA-512:	8F1D91BF6EA513349AB25FF0374947C6F55960B94A302CBEE660678F5BF9888EFFD73288EDB0C0429CBC17F8FD54993B9D489D8D8552F65E1C9AF4706F44A775
Malicious:	false
Preview:	Oct 6 15:24:13 galassia kernel: [ 129.254576] blocking signal 9: 5536 -> 780.Oct 6 15:24:13 galassia kernel: [ 129.697686] blocking signal 9: 5536 -> 940.Oct 6 15:24:13 galassia kernel: [ 129.746107] blocking signal 9: 5536 -> 1289.Oct 6 15:24:13 galassia kernel: [ 129.960386] blocking signal 9: 5536 -> 1589.Oct 6 15:24:13 galassia kernel: [ 130.200897] blocking signal 9: 5536 -> 3094.Oct 6 15:24:13 galassia kernel: [ 130.335053] blocking signal 9: 5536 -> 3157.Oct 6 15:24:13 galassia kernel: [ 130.564347] blocking signal 9: 5542 -> 661.Oct 6 15:24:13 galassia kernel: [ 130.765774] blocking signal 9: 5542 -> 725.Oct 6 15:24:13 galassia kernel: [ 131.070734] blocking signal 9: 5542 -> 780.Oct 6 15:24:13 galassia kernel: [ 131.155676] blocking signal 9: 5542 -> 940.Oct 6 15:24:13 galassia kernel: [ 131.170754] New task spawned: old: (tgid 5593, tid 5593), new (tgid: 5593, tid: 5599).Oct 6 15:24:13 galassia kernel: [ 131.173348] New task spawned: old: (tgid 5593, t

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	150284
Entropy (8bit):	5.20602769427706
Encrypted:	false
SSDEEP:	768:k0J0Lg4hxswsJVLK7Hb0Vp5ue7G9s7zuASplp/pIthM+ndDojG+KMNcrdbv6pt3s:gsLNNo9NNcrdbimTv
MD5:	29F6639630BBEE1D0D40083BF1D81259
SHA1:	B4E50FA751F8C50DAC9CA4DD8AE365F72843EBB7
SHA-256:	701D7C97C6A02B43EA912EFE2A6E0849E7BCEAB243E6FC9D94307523D185841F
SHA-512:	9874335D50B59441B2B7ABF2FA16AD4E2170D199A8005411B677D88DE16D9754483459DB7BF57D2472760F8DEE3EF66F12A28D6D371963F9744F2439A14B170E
Malicious:	false
Preview:	Oct 6 15:24:11 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 6 15:24:13 galassia kernel: [ 129.254576] blocking signal 9: 5536 -> 780.Oct 6 15:24:13 galassia kernel: [ 129.697686] blocking signal 9: 5536 -> 940.Oct 6 15:24:13 galassia kernel: [ 129.746107] blocking signal 9: 5536 -> 1289.Oct 6 15:24:13 galassia kernel: [ 129.960386] blocking signal 9: 5536 -> 1589.Oct 6 15:24:13 galassia kernel: [ 130.200897] blocking signal 9: 5536 -> 3094.Oct 6 15:24:13 galassia kernel: [ 130.335053] blocking signal 9: 5536 -> 3157.Oct 6 15:24:13 galassia kernel: [ 130.564347] blocking signal 9: 5542 -> 661.Oct 6 15:24:13 galassia kernel: [ 130.765774] blocking signal 9: 5542 -> 725.Oct 6 15:24:11 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 6 15:24:13 galassia kernel: [ 131.070734] blocking signal 9: 5542 -> 780.Oct 6 15:24:13 galassia kernel: [ 131.155676] blocking signal 9: 5542 -> 940.Oct 6 15:24:13 galas

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018082
Encrypted:	false
SSDEEP:	3:PCsXlXEWtl/7w1blt:3+ylE1bl
MD5:	DC5285C3BD9AE2C6179BCFEE5E028C95
SHA1:	58DACA1C3E7F82A5CF583D70D8F406A472A81355
SHA-256:	761BD536DD3EB379EC5144AFC776FF1C3D5A6B648D282F677C0A4F1A61E8B3EC
SHA-512:	5531A3778DD4245F4C90599DF15870B65E8EFA4394DD9E20115B6391A25B8CFD6ED80584890DB0634BF3369C37C4EBD3249C4AF93479F0A46835D24DA712186E
Malicious:	true
Preview:	....(...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................(......g.P......................................

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.078505608639901
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	67'016 bytes
MD5:	9eef3745fa9ab355e2300ab5f3ac14b6
SHA1:	fcc3c4abb47024784d83b711206c374cae360e09
SHA256:	4338bf50d8af5196c52c91e76e6ae279ed45517d2afd65bc82ef7dc2a74a879b
SHA512:	7a2b6130ebdbe5c6e908c216275579b6877d951df738eb338bde2a388ba0882eaf56f5094dbfe0d1388b782d7f069a4c1eec6efbb9a2358652a61a052c30e310
SSDEEP:	1536:M3CWMcY+K9Pz9hyZsoqPthP6XCGOE5/lPtTEAj:M3CVcc9hyZO+XCaNlxV
TLSH:	8D633B91BC815612C6D422BBFB6E428D332A53A8D1EF32079D256F5137C692F0E77742
File Content Preview:	.ELF...a..........(.........4...8.......4. ...(.........................................................t&..........Q.td..................................-...L."....:..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	66616
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xe87c	0x0	0x6	AX	16
.fini	PROGBITS	0x1692c	0xe92c	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x16940	0xe940	0x15a4	0x0	0x2	A	4
.ctors	PROGBITS	0x18000	0x10000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x18008	0x10008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x18014	0x10014	0x3e4	0x0	0x3	WA	4
.bss	NOBITS	0x183f8	0x103f8	0x227c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x103f8	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xfee4	0xfee4	6.1313	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x10000	0x18000	0x18000	0x3f8	0x2674	2.5099	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 22:24:08.717984915 CEST	192.168.2.14	8.8.8.8	0x65d2	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:24:09.823626041 CEST	192.168.2.14	8.8.8.8	0x8321	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:24:12.012384892 CEST	192.168.2.14	8.8.8.8	0x6cf1	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 22:24:08.724596977 CEST	8.8.8.8	192.168.2.14	0x65d2	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:24:09.830838919 CEST	8.8.8.8	192.168.2.14	0x8321	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:24:12.019670963 CEST	8.8.8.8	192.168.2.14	0x6cf1	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false

Start time (UTC):	20:24:07
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:24:08
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:24:11
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:12
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:15
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:14
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:16
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:18
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:19
Start date (UTC):	06/10/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:24:20
Start date (UTC):	06/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:24:21
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:22
Start date (UTC):	06/10/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:24:24
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:34
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5746/oom_score_adj

/proc/5749/oom_score_adj

/proc/5751/oom_score_adj

/proc/5753/oom_score_adj

/proc/5755/oom_score_adj

/proc/5757/oom_score_adj

/proc/5760/oom_score_adj

/proc/5836/oom_score_adj

/proc/5864/oom_score_adj

/proc/5869/oom_score_adj

/proc/5871/oom_score_adj

/proc/5873/oom_score_adj

/proc/5875/oom_score_adj

/proc/5877/oom_score_adj

/proc/5880/oom_score_adj

/proc/6059/oom_score_adj

/proc/6216/oom_score_adj

/proc/6233/oom_score_adj

/proc/6452/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1WTTKwh

/run/systemd/inhibit/.#2ZhUHMe

/run/systemd/inhibit/.#3obreTd

/run/systemd/inhibit/.#4FlvpTf

/run/systemd/seats/.#seat03JEbje

Linux Analysis Report
na.elf

Start time (UTC):	20:24:37
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:24:39
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:24:40
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	20:24:41
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:24:42
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:24:43
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:24:44
Start date (UTC):	06/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	20:24:45
Start date (UTC):	06/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	20:24:47
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:24:50
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a