Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1527297
MD5: 72a294f4d8218daac78d35c0b28a65fa
SHA1: ca5800715586c9cea8658f08de7384a3d0ff0732
SHA256: 954311d415ff6e1f159792b974e1333ef6824907255ecb8582ed66326dcb3d07
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Yara detected Mirai
Yara detected Okiru
Machine Learning detection for sample
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Deletes log files
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Found strings indicative of a multi-platform dropper
Reads CPU information from /sys indicative of miner or evasive malware
Reads system version information
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 73%
Machine Learning detection for sample
Source: na.elf Joe Sandbox ML: detected
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pkill (PID: 5680) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5710) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5754) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5772) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Found strings indicative of a multi-platform dropper
Source: na.elf String: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpcurl/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcanko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverbyte-mirai.kro.kr68.183.18.151
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:35718 -> 154.216.20.119:777
Reads the 'hosts' file potentially containing internal network hosts
Source: /usr/sbin/rsyslogd (PID: 5597) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5605) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5681) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5688) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5709) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5729) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5755) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5758) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5771) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5773) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5777) Reads hosts file: /etc/hosts Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 72.93.228.19
Source: unknown TCP traffic detected without corresponding DNS query: 195.126.226.112
Source: unknown TCP traffic detected without corresponding DNS query: 122.8.5.167
Source: unknown TCP traffic detected without corresponding DNS query: 171.212.71.219
Source: unknown TCP traffic detected without corresponding DNS query: 185.86.219.156
Source: unknown TCP traffic detected without corresponding DNS query: 34.122.196.78
Source: unknown TCP traffic detected without corresponding DNS query: 205.156.113.176
Source: unknown TCP traffic detected without corresponding DNS query: 76.116.181.248
Source: unknown TCP traffic detected without corresponding DNS query: 166.2.175.177
Source: unknown TCP traffic detected without corresponding DNS query: 188.156.236.173
Source: unknown TCP traffic detected without corresponding DNS query: 128.15.141.222
Source: unknown TCP traffic detected without corresponding DNS query: 59.245.232.20
Source: unknown TCP traffic detected without corresponding DNS query: 67.239.14.222
Source: unknown TCP traffic detected without corresponding DNS query: 121.201.105.214
Source: unknown TCP traffic detected without corresponding DNS query: 166.138.116.106
Source: unknown TCP traffic detected without corresponding DNS query: 13.239.22.31
Source: unknown TCP traffic detected without corresponding DNS query: 54.199.161.105
Source: unknown TCP traffic detected without corresponding DNS query: 163.243.139.139
Source: unknown TCP traffic detected without corresponding DNS query: 209.0.170.61
Source: unknown TCP traffic detected without corresponding DNS query: 57.154.73.181
Source: unknown TCP traffic detected without corresponding DNS query: 24.214.121.17
Source: unknown TCP traffic detected without corresponding DNS query: 176.81.209.177
Source: unknown TCP traffic detected without corresponding DNS query: 204.84.31.123
Source: unknown TCP traffic detected without corresponding DNS query: 159.45.3.46
Source: unknown TCP traffic detected without corresponding DNS query: 40.216.115.41
Source: unknown TCP traffic detected without corresponding DNS query: 93.102.194.52
Source: unknown TCP traffic detected without corresponding DNS query: 143.16.233.111
Source: unknown TCP traffic detected without corresponding DNS query: 14.174.164.241
Source: unknown TCP traffic detected without corresponding DNS query: 199.82.87.157
Source: unknown TCP traffic detected without corresponding DNS query: 179.251.162.1
Source: unknown TCP traffic detected without corresponding DNS query: 74.186.6.176
Source: unknown TCP traffic detected without corresponding DNS query: 159.57.99.238
Source: unknown TCP traffic detected without corresponding DNS query: 218.53.7.165
Source: unknown TCP traffic detected without corresponding DNS query: 199.143.68.183
Source: unknown TCP traffic detected without corresponding DNS query: 202.13.59.28
Source: unknown TCP traffic detected without corresponding DNS query: 105.189.52.180
Source: unknown TCP traffic detected without corresponding DNS query: 164.14.91.97
Source: unknown TCP traffic detected without corresponding DNS query: 193.186.70.125
Source: unknown TCP traffic detected without corresponding DNS query: 42.66.97.147
Source: unknown TCP traffic detected without corresponding DNS query: 111.89.65.223
Source: unknown TCP traffic detected without corresponding DNS query: 99.33.149.146
Source: unknown TCP traffic detected without corresponding DNS query: 112.42.12.27
Source: unknown TCP traffic detected without corresponding DNS query: 165.113.102.51
Source: unknown TCP traffic detected without corresponding DNS query: 130.76.206.225
Source: unknown TCP traffic detected without corresponding DNS query: 187.111.79.247
Source: unknown TCP traffic detected without corresponding DNS query: 196.196.220.255
Source: unknown TCP traffic detected without corresponding DNS query: 118.95.62.163
Source: unknown TCP traffic detected without corresponding DNS query: 178.61.163.219
Source: unknown TCP traffic detected without corresponding DNS query: 216.50.3.132
Source: unknown TCP traffic detected without corresponding DNS query: 99.204.55.117
Source: global traffic DNS traffic detected: DNS query: byte-mirai.kro.kr
Source: syslog.51.dr, syslog.93.dr, syslog.57.dr, syslog.87.dr, syslog.126.dr, syslog.32.dr, syslog.24.dr String found in binary or memory: https://www.rsyslog.com

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample tries to kill a massive number of system processes
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 133, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 208, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 211, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 212, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 213, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 215, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 675, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 681, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 723, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 777, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 933, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 911, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent to PID below 1000: pid: 914, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 133, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 208, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 211, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 212, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 213, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 215, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 675, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 681, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 723, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 724, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 777, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 782, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 789, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 796, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 933, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 911, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent to PID below 1000: pid: 914, result: successful Jump to behavior
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 133, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 208, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 211, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 212, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 213, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 215, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 675, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 681, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 723, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1185, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1617, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1875, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 2527, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3183, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3188, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3192, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3368, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3394, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3461, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3465, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3469, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3475, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3483, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3488, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3799, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3800, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3801, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3802, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 911, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 914, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5604, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5605, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5675, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5687, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5688, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5692, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5707, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5753, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5755, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5770, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5771, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5774, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5776, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5777, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 133, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 208, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 211, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 212, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 213, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 215, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 675, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 681, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 723, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 724, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 782, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 789, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 796, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1185, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1440, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1617, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1875, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 2527, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3060, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3183, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3188, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3192, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3368, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3394, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3461, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3465, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3469, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3475, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3483, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3488, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3799, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3800, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3801, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3802, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5528, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5594, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5596, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5597, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 911, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 914, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5681, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5687, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5688, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5692, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5708, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5709, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5729, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5733, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5732, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5758, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5762, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5769, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5773, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpcurl/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcanko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverbyte-mirai.kro.kr68.183.18.151
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 133, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 208, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 211, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 212, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 213, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 215, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 675, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 681, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 723, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1185, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1617, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 1875, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 2527, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3183, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3188, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3192, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3368, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3394, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3461, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3465, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3469, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3475, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3483, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3488, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3799, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3800, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3801, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 3802, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 911, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 914, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5604, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5605, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5675, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5687, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5688, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5692, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5707, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5753, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5755, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5770, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5771, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5774, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5776, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5552) SIGKILL sent: pid: 5777, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 133, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 208, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 211, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 212, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 213, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 215, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 277, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 278, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 279, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 280, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 281, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 282, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 283, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 284, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 285, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 286, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 287, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 288, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 289, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 290, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 292, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 294, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 295, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 296, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 297, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 301, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 302, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 305, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 329, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 675, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 681, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 723, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 724, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 740, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 782, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 789, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 796, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1185, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1333, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1440, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1617, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 1875, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 2527, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3060, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3183, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3188, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3192, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3368, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3394, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3461, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3465, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3469, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3475, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3483, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3488, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3799, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3800, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3801, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3802, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5528, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5594, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5596, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5597, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 911, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 914, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 3210, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5681, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5687, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5688, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5692, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5708, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5709, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5729, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5733, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5732, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5758, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5762, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5769, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5555) SIGKILL sent: pid: 5773, result: successful Jump to behavior
Yara signature match
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: na.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engine Classification label: mal100.spre.troj.linELF@0/28@97/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 5594) File: /proc/5594/mounts Jump to behavior
Source: /bin/fusermount (PID: 5595) File: /proc/5595/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5604) File: /proc/5604/mounts Jump to behavior
Creates hidden files and/or directories
Source: /lib/systemd/systemd-logind (PID: 5616) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5616) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5616) File: /run/systemd/seats/.#seat0hNKJFS Jump to behavior
Enumerates processes within the "proc" file system
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/5388/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/5388/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/110/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/110/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/231/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/231/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/111/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/111/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/112/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/112/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/233/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/233/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/113/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/113/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/114/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/114/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/235/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/235/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/115/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/115/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/116/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/116/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/117/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/117/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/118/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/118/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/119/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/119/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/911/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/911/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/914/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/914/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/10/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/10/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/11/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/11/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/12/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/12/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/13/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/13/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/14/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/14/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/15/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/15/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/16/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/16/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/17/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/17/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/18/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/18/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/19/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/19/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/120/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/120/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/121/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/121/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/1/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/1/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/122/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/122/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/243/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/243/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/2/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/2/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/123/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/123/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/3/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/3/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/124/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/124/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/125/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/125/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/4/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/4/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/246/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/246/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/126/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/126/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/5/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/5/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/127/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/127/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/6/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/6/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/128/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/128/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/7/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/7/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/129/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/129/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/8/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/8/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/9/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/9/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/20/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/20/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/21/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/21/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/22/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/22/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/23/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/23/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/24/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/24/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/25/status Jump to behavior
Source: /usr/bin/pkill (PID: 5680) File opened: /proc/25/cmdline Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/bin/gpu-manager (PID: 5677) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5693) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5695) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5697) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5699) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5701) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5703) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5741) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5743) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5745) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5747) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5749) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5763) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5765) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5767) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5780) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5694) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5696) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5698) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5700) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5702) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5704) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5742) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5744) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5746) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5748) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5750) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5764) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5766) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5768) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5781) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Executes the "kill" or "pkill" command typically used to terminate processes
Source: /usr/share/gdm/generate-config (PID: 5680) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5710) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5754) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5772) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5784) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Reads system version information
Source: /sbin/agetty (PID: 5687) Reads version info: /etc/issue Jump to behavior
Source: /sbin/agetty (PID: 5707) Reads version info: /etc/issue Jump to behavior
Source: /sbin/agetty (PID: 5732) Reads version info: /etc/issue Jump to behavior
Source: /sbin/agetty (PID: 5769) Reads version info: /etc/issue Jump to behavior
Source: /sbin/agetty (PID: 5774) Reads version info: /etc/issue Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5597) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5605) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5605) Log file created: /var/log/auth.log Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5681) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5688) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5709) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5729) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5758) Log file created: /var/log/kern.log Jump to dropped file
Deletes log files
Source: /usr/bin/gpu-manager (PID: 5675) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5692) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5733) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5762) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5776) Truncated file: /var/log/gpu-manager.log Jump to behavior
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pkill (PID: 5680) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5710) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5754) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5772) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /usr/sbin/rsyslogd (PID: 5597) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5605) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5681) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5687) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5688) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5692) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5707) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5709) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5729) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5732) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5755) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5758) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5769) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5771) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5773) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5774) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5777) Queries kernel information via 'uname': Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5553, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5556, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5553, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5556, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5553, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5556, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5551.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5553.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5556.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5551, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5553, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5556, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
209.28.118.159
 unknown United States
3300 BTNL false
220.112.128.103
 unknown China
17623 CNCGROUP-SZChinaUnicomShenzennetworkCN false
42.251.164.109
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
81.251.170.14
 unknown France
3215 FranceTelecom-OrangeFR false
14.48.63.131
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
196.122.235.75
 unknown Morocco
36925 ASMediMA false
187.202.33.19
 unknown Mexico
8151 UninetSAdeCVMX false
20.239.176.93
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
77.34.139.158
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
118.16.102.226
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
122.55.219.226
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
142.224.225.13
 unknown Canada
13576 SDNW-13576US false
195.199.133.13
 unknown Hungary
1955 HBONE-ASHUNGARNETHU false
13.71.38.141
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
48.8.237.251
 unknown United States
2686 ATGS-MMD-ASUS false
62.198.53.99
 unknown Denmark
3308 TELIANET-DENMARKDK false
130.225.89.238
 unknown Denmark
1835 FSKNET-DKForskningsnettet-DanishnetworkforResearchand false
35.94.247.159
 unknown United States
237 MERIT-AS-14US false
110.38.1.126
 unknown Pakistan
38264 WATEEN-IMS-PK-AS-APNationalWiMAXIMSenvironmentPK false
178.69.143.147
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
222.16.182.11
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
69.122.191.204
 unknown United States
6128 CABLE-NET-1US false
42.85.18.254
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
60.179.184.179
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
78.16.135.38
 unknown Ireland
2110 AS-BTIREBTIrelandwaspreviouslyknownasEsatNetEUnet false
60.109.253.157
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
135.73.117.225
 unknown United States
18676 AVAYAUS false
149.20.37.16
 unknown United States
1280 ISC-AS-1280US false
124.55.105.213
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
125.193.138.124
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
185.155.11.154
 unknown Iran (ISLAMIC Republic Of)
49100 IR-THR-PTEIR false
102.21.168.174
 unknown unknown
37054 Telecom-MalagasyMG false
104.30.121.93
 unknown United States
13335 CLOUDFLARENETUS false
206.99.173.188
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
146.24.28.221
 unknown United States
197938 TRAVIANGAMESDE false
176.149.9.226
 unknown France
5410 BOUYGTEL-ISPFR false
157.252.45.11
 unknown United States
3592 TRINCOLL-ASUS false
34.96.170.47
 unknown United States
15169 GOOGLEUS false
19.77.137.140
 unknown United States
3 MIT-GATEWAYSUS false
59.165.111.89
 unknown India
17908 TCISLTataCommunicationsIN false
95.117.176.80
 unknown Germany
6805 TDDE-ASN1DE false
107.221.210.249
 unknown United States
7018 ATT-INTERNET4US false
42.3.137.205
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
220.235.156.18
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
52.122.36.6
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
81.89.1.16
 unknown Romania
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
213.40.160.111
 unknown United Kingdom
9142 CommercialISPGB false
205.201.209.89
 unknown United States
6653 FORETHOUGHTNETUS false
135.83.183.48
 unknown United States
18676 AVAYAUS false
124.165.74.206
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
145.40.240.25
 unknown Netherlands
8758 IWAYCH false
173.48.189.163
 unknown United States
701 UUNETUS false
89.221.130.80
 unknown Italy
41734 COMIFAR-ASIT false
155.167.154.236
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
159.38.64.77
 unknown Sweden
19399 SLLNETEU false
195.163.128.14
 unknown Sweden
5400 BTGB false
78.86.61.95
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
132.184.214.53
 unknown Peru
21575 ENTELPERUSAPE false
204.62.25.217
 unknown United States
40628 OKLAHOMA-OMESUS false
37.251.110.134
 unknown Netherlands
49562 XMSNL false
73.151.20.231
 unknown United States
7922 COMCAST-7922US false
54.122.159.217
 unknown United States
16509 AMAZON-02US false
42.201.110.127
 unknown China
4515 ERX-STARHKTLimitedHK false
167.146.23.57
 unknown United States
22527 22527US false
19.38.174.239
 unknown United States
3 MIT-GATEWAYSUS false
103.107.91.136
 unknown India
132470 NEXTRAT-AS-APNextraTelesolutionsPrivateLimitedIN false
218.127.133.200
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
74.30.218.216
 unknown United States
7922 COMCAST-7922US false
159.168.18.227
 unknown Switzerland
28686 AVECTRIS-ASCH false
155.48.59.65
 unknown United States
16481 BABSON-GNETUS false
187.18.188.136
 unknown Brazil
28270 VideomarRedeNordesteSABR false
1.169.152.18
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
125.226.158.61
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
36.194.65.147
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
165.148.31.67
 unknown South Africa
5734 TIENETZA false
46.201.252.63
 unknown Ukraine
6849 UKRTELNETUA false
59.211.95.93
 unknown China
2516 KDDIKDDICORPORATIONJP false
78.119.187.138
 unknown France
8228 CEGETEL-ASFR false
159.246.182.45
 unknown United States
29899 GEISINGERUS false
49.157.91.254
 unknown Philippines
9658 ETPI-IDS-AS-APEasternTelecomsPhilsIncPH false
115.38.202.86
 unknown Japan 18126 CTCXChubuTelecommunicationsCompanyIncJP false
119.153.180.207
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
165.56.131.227
 unknown Zambia
37154 ZAMTELZM false
85.90.55.72
 unknown United Kingdom
39116 TELEHOUSEGB false
1.71.43.37
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
68.189.209.139
 unknown United States
20115 CHARTER-20115US false
139.103.227.204
 unknown Canada
611 NECN-1-611CA false
37.202.175.94
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
183.80.206.1
 unknown Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
118.80.234.145
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
70.46.105.190
 unknown United States
7029 WINDSTREAMUS false
193.76.218.183
 unknown Italy
1267 ASN-WINDTREIUNETEU false
157.136.166.7
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
197.4.29.87
 unknown Tunisia
5438 ATI-TN false
137.148.127.167
 unknown United States
32818 CSUOHIO-ASUS false
183.73.81.117
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
122.238.49.27
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
110.17.77.118
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
131.199.228.82
 unknown United States
1341 ROCKWELLCOLLINS-ASUS false
173.115.55.70
 unknown United States
10507 SPCSUS false

Contacted Domains

Name IP Active
byte-mirai.kro.kr 154.216.20.119 true