Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1527300
MD5: f4ceea6be2ae4ed6a2cdb4dae78d97ff
SHA1: cd31d196975edf2d0fd39c257b9fab2240d7a69a
SHA256: 6fa06e0cea4a02eeb601de420ef0e70c056f5dbd8c6b32df824c051c6a224435
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Yara detected Mirai
Yara detected Okiru
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Deletes log files
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Found strings indicative of a multi-platform dropper
Reads CPU information from /sys indicative of miner or evasive malware
Reads system version information
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 75%
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pulseaudio (PID: 5482) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5586) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5730) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5770) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5994) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6132) Reads CPU info from /sys: /sys/devices/system/cpu/online
Found strings indicative of a multi-platform dropper
Source: na.elf String: N^Nubyte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpcurl/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:37400 -> 154.216.20.119:777
Reads the 'hosts' file potentially containing internal network hosts
Source: /usr/sbin/rsyslogd (PID: 5483) Reads hosts file: /etc/hosts Jump to behavior
Sample listens on a socket
Source: /usr/sbin/gdm3 (PID: 5592) Socket: unknown address family Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5626) Socket: unknown address family Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5627) Socket: unknown address family Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5707) Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5729) Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5708) Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5871) Socket: unknown address family
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 19.60.231.10
Source: unknown TCP traffic detected without corresponding DNS query: 207.173.151.10
Source: unknown TCP traffic detected without corresponding DNS query: 50.182.140.9
Source: unknown TCP traffic detected without corresponding DNS query: 34.21.67.159
Source: unknown TCP traffic detected without corresponding DNS query: 139.187.21.89
Source: unknown TCP traffic detected without corresponding DNS query: 190.134.17.103
Source: unknown TCP traffic detected without corresponding DNS query: 201.192.154.128
Source: unknown TCP traffic detected without corresponding DNS query: 68.185.250.187
Source: unknown TCP traffic detected without corresponding DNS query: 13.220.25.231
Source: unknown TCP traffic detected without corresponding DNS query: 179.184.64.115
Source: unknown TCP traffic detected without corresponding DNS query: 77.222.176.241
Source: unknown TCP traffic detected without corresponding DNS query: 8.225.246.80
Source: unknown TCP traffic detected without corresponding DNS query: 60.158.124.252
Source: unknown TCP traffic detected without corresponding DNS query: 63.181.246.193
Source: unknown TCP traffic detected without corresponding DNS query: 191.202.89.201
Source: unknown TCP traffic detected without corresponding DNS query: 175.31.121.34
Source: unknown TCP traffic detected without corresponding DNS query: 14.147.91.181
Source: unknown TCP traffic detected without corresponding DNS query: 143.42.216.231
Source: unknown TCP traffic detected without corresponding DNS query: 83.224.70.146
Source: unknown TCP traffic detected without corresponding DNS query: 42.106.83.4
Source: unknown TCP traffic detected without corresponding DNS query: 20.236.170.223
Source: unknown TCP traffic detected without corresponding DNS query: 118.132.54.74
Source: unknown TCP traffic detected without corresponding DNS query: 182.225.221.77
Source: unknown TCP traffic detected without corresponding DNS query: 212.52.0.112
Source: unknown TCP traffic detected without corresponding DNS query: 220.168.179.145
Source: unknown TCP traffic detected without corresponding DNS query: 68.75.88.237
Source: unknown TCP traffic detected without corresponding DNS query: 193.170.208.96
Source: unknown TCP traffic detected without corresponding DNS query: 5.21.202.142
Source: unknown TCP traffic detected without corresponding DNS query: 212.33.173.36
Source: unknown TCP traffic detected without corresponding DNS query: 130.114.211.106
Source: unknown TCP traffic detected without corresponding DNS query: 101.32.80.214
Source: unknown TCP traffic detected without corresponding DNS query: 64.196.4.150
Source: unknown TCP traffic detected without corresponding DNS query: 124.80.55.172
Source: unknown TCP traffic detected without corresponding DNS query: 126.150.75.61
Source: unknown TCP traffic detected without corresponding DNS query: 172.172.57.134
Source: unknown TCP traffic detected without corresponding DNS query: 86.154.215.162
Source: unknown TCP traffic detected without corresponding DNS query: 122.91.79.60
Source: unknown TCP traffic detected without corresponding DNS query: 166.133.75.179
Source: unknown TCP traffic detected without corresponding DNS query: 58.132.32.230
Source: unknown TCP traffic detected without corresponding DNS query: 183.48.243.221
Source: unknown TCP traffic detected without corresponding DNS query: 124.236.83.167
Source: unknown TCP traffic detected without corresponding DNS query: 163.230.209.6
Source: unknown TCP traffic detected without corresponding DNS query: 186.71.7.95
Source: unknown TCP traffic detected without corresponding DNS query: 79.85.35.8
Source: unknown TCP traffic detected without corresponding DNS query: 100.254.90.20
Source: unknown TCP traffic detected without corresponding DNS query: 106.43.87.92
Source: unknown TCP traffic detected without corresponding DNS query: 90.34.248.61
Source: unknown TCP traffic detected without corresponding DNS query: 45.232.32.173
Source: unknown TCP traffic detected without corresponding DNS query: 47.237.98.241
Source: unknown TCP traffic detected without corresponding DNS query: 150.202.213.95
Source: global traffic DNS traffic detected: DNS query: byte-mirai.kro.kr
Source: syslog.26.dr, Xorg.0.log.149.dr String found in binary or memory: http://wiki.x.org
Source: syslog.26.dr, Xorg.0.log.149.dr String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.26.dr String found in binary or memory: https://www.rsyslog.com
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary
barindex
Sample tries to kill a massive number of system processes
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 783, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 795, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent to PID below 1000: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent to PID below 1000: pid: 936, result: successful Jump to behavior
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 783, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 795, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1648, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 2970, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3095, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3182, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3420, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3424, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3429, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3434, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3442, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3709, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3710, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3711, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3712, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 5407, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 5425, result: unknown Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3095, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3182, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3420, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3424, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3429, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3434, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3442, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3709, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3710, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3711, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3712, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 5427, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 5430, result: unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5707) SIGKILL sent: pid: 5723, result: successful
Source: /usr/bin/dbus-daemon (PID: 5707) SIGKILL sent: pid: 5946, result: successful
Source: /usr/bin/dbus-daemon (PID: 5707) SIGKILL sent: pid: 6125, result: successful
Source: /usr/bin/dbus-daemon (PID: 5729) SIGKILL sent: pid: 6104, result: successful
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: N^Nubyte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpcurl/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 783, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 795, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 1648, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 2970, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3095, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3182, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3420, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3424, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3429, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3434, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3442, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3709, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3710, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3711, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 3712, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 5407, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5425) SIGKILL sent: pid: 5425, result: unknown Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 1 (init), result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3095, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3100, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3182, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3420, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3424, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3429, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3434, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3442, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3709, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3710, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3711, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 3712, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 5427, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5430) SIGKILL sent: pid: 5430, result: unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5707) SIGKILL sent: pid: 5723, result: successful
Source: /usr/bin/dbus-daemon (PID: 5707) SIGKILL sent: pid: 5946, result: successful
Source: /usr/bin/dbus-daemon (PID: 5707) SIGKILL sent: pid: 6125, result: successful
Source: /usr/bin/dbus-daemon (PID: 5729) SIGKILL sent: pid: 6104, result: successful
Source: classification engine Classification label: mal92.spre.troj.linELF@0/100@1/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 5481) File: /proc/5481/mounts Jump to behavior
Source: /bin/fusermount (PID: 5486) File: /proc/5486/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5626) File: /proc/5626/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5707) File: /proc/5707/mounts
Source: /usr/bin/dbus-daemon (PID: 5729) File: /proc/5729/mounts
Source: /usr/bin/gjs (PID: 6126) File: /proc/6126/mounts
Source: /usr/bin/gnome-shell (PID: 5770) File: /proc/5770/mounts
Source: /usr/bin/dbus-daemon (PID: 5621) File: /proc/5621/mounts
Source: /usr/bin/dbus-daemon (PID: 6116) File: /proc/6116/mounts
Creates hidden files and/or directories
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0lczUtX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#12735aB7T Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127qlsbhV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1Bv606W Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127SBljFX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0wrsKvV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127sLJRrU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1uo1PVW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1MneO4T Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127xykiMX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (21)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (20)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0kTR4KW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1Rq5OdU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127IOV4PT Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1R3Lb3T Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1GAD4dV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c1EgYguU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127A7YetV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (20)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (19)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0ssUUOX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127Z7FW4T Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0qVyVCX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127UnD19W Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0o48q5T Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127Iyp7fW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2JFu0eV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#127Yfq1fX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/seats/.#seat0Njj6ZU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c28pv7aX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c20EhCSW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/users/.#1275KRIlW Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2y2QSzX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c21LkI5X Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (21)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2q2utUX Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c26Q9cQU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (24)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/sessions/.#c2gOKhDV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/inhibit/.#12u1eDV Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/inhibit/.#2GDtJoU Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/inhibit/.#3eaWt7X Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498) File: /run/systemd/inhibit/.#4JVsO5X Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5557) Directory: /root/.cache Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5647) Directory: <invalid fd (11)>/.. Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5647) Directory: <invalid fd (10)>/.. Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690) Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5690) Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711) Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5730) Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740) Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5770) Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5770) Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5770) Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5770) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5770) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5770) Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5770) Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 5945) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 5945) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6144) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6144) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6146) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6146) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6147) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6147) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6149) Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6149) Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153) Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6170) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6170) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598) Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598) Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 5956) Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 5956) Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6121) Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6191) Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6374) Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6374) Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6423) Directory: /var/lib/colord/.cache
Enumerates processes within the "proc" file system
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5481/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5481/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6153/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5482/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5482/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5482/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6132/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6132/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6374/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6431/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5686/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6114/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6598/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6191/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6170/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5619/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6149/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6149/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5557/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5999/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5999/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5615/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5615/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5956/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5690/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6142/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5592/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5495/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5770/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5792/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6121/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6121/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6341/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6146/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5498/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5674/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5674/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6148/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6423/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5994/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5994/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5994/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5598/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6147/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/1/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5708/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6117/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/6578/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5647/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481) File opened: /proc/5627/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/5264/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/238/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/239/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/19/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/240/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/3095/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/241/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/242/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/244/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/245/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/246/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/5/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/247/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/na.elf (PID: 5430) File opened: /proc/248/cmdline Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/bin/gpu-manager (PID: 5564) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5567) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5569) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5571) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5573) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5575) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5577) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5579) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5699) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 5948) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5610) Shell command executed: sh -c "locale -a | grep -F .utf8 "
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5565) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5568) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5570) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5572) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5574) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5576) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5578) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5580) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5612) Grep executable: /usr/bin/grep -> grep -F .utf8
Executes the "kill" or "pkill" command typically used to terminate processes
Source: /usr/share/gdm/generate-config (PID: 5586) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Reads system version information
Source: /sbin/agetty (PID: 5566) Reads version info: /etc/issue Jump to behavior
Sample tries to set the executable flag
Source: /usr/sbin/gdm3 (PID: 5592) File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5592) File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/rsyslogd (PID: 5483) Log file created: /var/log/auth.log Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5483) Log file created: /var/log/kern.log Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5563) Log file created: /var/log/gpu-manager.log Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5690) Log file created: /var/log/Xorg.0.log Jump to dropped file
Deletes log files
Source: /usr/bin/gpu-manager (PID: 5563) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690) Truncated file: /var/log/Xorg.pid-5690.log
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pulseaudio (PID: 5482) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 5586) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5730) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5770) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5994) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6132) Reads CPU info from /sys: /sys/devices/system/cpu/online
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5423) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5482) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5483) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5563) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5566) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5615) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5627) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5674) Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5686) Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5690) Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5724) Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6105) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5708) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5730) Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740) Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5770) Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 5945) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6144) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6146) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6147) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6151) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6153) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6170) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5994) Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6117) Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6121) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6132) Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6191) Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6578) Queries kernel information via 'uname':
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.816] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.169] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.237] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.890] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.222] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.714] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.968] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.686] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.610] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.073] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.591] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.203] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.847] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.378] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.364] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.177] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.grn: 8
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.638] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.320] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.735] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.543] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.991] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.517] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.011] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.506] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.942] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.333] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.091] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.108] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.575] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.540] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.969] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.502] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.587] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.094] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.285] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.853] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.216] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.758] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.258] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 153.433] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.035] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.458] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.414] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.959] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.142] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.919] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.903] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.914] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.273] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.342] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.161] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.227] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.373] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.270] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.536] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.183] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.627] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.387] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.804] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.731] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.479] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.275] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.461] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.635] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 153.481] (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.867] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.815] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.437] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.209] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.238] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.957] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.207] (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.939] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.547] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) LoadModule: "vmware"
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.622] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.919] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.923] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.700] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 157.292] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.614] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.525] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: na.elf, 5423.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5425.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5426.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5427.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5430.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5436.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.974] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.759] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.976] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.714] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.551] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): bpp: 32
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.934] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.049] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.510] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.706] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.646] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.118] (--) vmware(0): mheig: 885
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.191] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.690] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.373] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.482] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.736] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.744] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.562] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.944] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.513] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.964] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.775] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.248] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): vis: 4
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.909] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.354] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.104] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.521] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.042] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.888] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.109] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.990] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.409] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.469] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.726] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.311] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.868] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.351] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.829] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.440] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): RGB weight 888
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): pbase: 0xe8000000
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.441] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.395] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.764] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.230] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.259] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.153] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.899] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.197] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.713] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.263] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.794] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.465] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.573] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr Binary or memory string: [ 157.310] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.985] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.872] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.763] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.929] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.684] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.355] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.234] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.123] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.492] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.245] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.448] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.170] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.267] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.587] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.858] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.949] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.293] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.747] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.374] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.424] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.419] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.404] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): mwidt: 1176
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.052] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.586] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.018] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.360] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.753] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.286] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.581] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.152] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.165] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.387] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.383] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.488] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.266] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.255] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: na.elf, 5425.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.Wn0gnn
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.566] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.598] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.809] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.344] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.741] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.114] (--) vmware(0): mwidt: 1176
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Using HW cursor
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.454] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.129] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.665] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.378] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.517] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.000] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.188] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: na.elf, 5423.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5425.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5426.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5427.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5430.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5436.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.731] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.513] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.302] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.710] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.842] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 153.414] (II) LoadModule: "vmware"
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.480] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.655] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.792] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.083] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.428] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.433] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.484] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: na.elf, 5423.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5425.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5426.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5427.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5430.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5436.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.752] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.873] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.499] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.096] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.149] (--) vmware(0): vis: 4
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.450] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.659] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.615] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.085] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.383] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.736] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.521] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: na.elf, 5430.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp Binary or memory string: U/tmp/qemu-open.mglKoN
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.251] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.495] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.363] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.763] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.863] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.315] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.527] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.879] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.820] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 157.301] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.346] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.863] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.369] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.884] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.473] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 160.034] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.785] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.656] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.954] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.242] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.463] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.328] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.547] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.557] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 157.250] (EE) vmware(0): Failed to open drm.
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.769] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.178] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.674] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.632] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.099] (--) vmware(0): bpp: 32
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.595] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.281] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.538] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.139] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.474] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.321] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.619] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.979] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.160] (==) vmware(0): RGB weight 888
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.559] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.453] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.073] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 153.634] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.400] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.945] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.605] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.701] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.476] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.277] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.298] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.472] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.420] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.149.dr Binary or memory string: [ 153.393] (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.636] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.695] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.641] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.532] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.695] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.144] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.570] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 153.751] (II) vmware(0): Creating default Display subsection in Screen section
Source: na.elf, 5430.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp Binary or memory string: /tmp/qemu-open.mglKoN
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.555] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: na.elf, 5425.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp Binary or memory string: /tmp/qemu-open.Wn0gnn
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.549] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.413] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.443] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): vram: 4194304
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.561] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.528] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.719] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.780] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 165.776] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.564] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.782] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.600] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.426] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.604] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.133] (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.837] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.216] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): mheig: 885
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.848] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.119] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.129] (--) vmware(0): bpp: 32
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.671] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.645] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.838] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr Binary or memory string: [ 158.681] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.773] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.149.dr Binary or memory string: [ 159.528] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.26.dr Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer

Language, Device and Operating System Detection
barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598) Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5423, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5425, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5427, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5430, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5436, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5423, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5425, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5427, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5430, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5436, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5423, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5425, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5427, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5430, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5436, type: MEMORYSTR
Yara detected Okiru
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5423, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5425, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5427, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5430, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5436, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
53.189.202.204
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
177.107.116.96
 unknown Brazil
53065 OpcaoTelecomBR false
159.182.65.118
 unknown United States
9823 NCS-PEARSON-AS-APEducationWebHostingAU false
119.189.17.175
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
137.146.160.13
 unknown United States
6056 COLBYUS false
85.218.82.205
 unknown Switzerland
34781 SIL-CITYCABLE-ASCH false
210.235.243.196
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
69.166.39.47
 unknown United States
393564 SPOKANEUS false
94.25.27.73
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
204.30.100.159
 unknown United States
3356 LEVEL3US false
196.158.82.219
 unknown Egypt
36935 Vodafone-EG false
66.157.249.129
 unknown United States
7018 ATT-INTERNET4US false
161.31.26.185
 unknown United States
40581 AREON-ASUS false
84.139.209.153
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
49.228.126.124
 unknown Thailand
133481 AIS-FIBRE-AS-APAISFibreTH false
197.90.198.156
 unknown South Africa
10474 OPTINETZA false
95.7.215.185
 unknown Turkey
9121 TTNETTR false
89.205.31.171
 unknown Macedonia
41557 TELEKABEL-ASMK false
169.153.233.5
 unknown United States
7867 TECHDATAUS false
79.85.35.8
 unknown France
15557 LDCOMNETFR false
12.224.246.67
 unknown United States
7018 ATT-INTERNET4US false
169.119.23.39
 unknown United States
37611 AfrihostZA false
149.118.255.206
 unknown United States
188 SAIC-ASUS false
179.18.249.94
 unknown Colombia
22698 AVANTELSASCO false
129.91.29.93
 unknown United States
63295 ORCL-CHICAGO1US false
118.68.42.183
 unknown Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
133.235.6.84
 unknown Japan 7682 HOTNETHOKKAIDOTELECOMMUNICATIONSNETWORKCoIncJP false
133.119.10.98
 unknown Japan 2522 PPP-EXPJapanNetworkInformationCenterJP false
34.199.141.141
 unknown United States
14618 AMAZON-AESUS false
164.52.64.123
 unknown China
63199 CDSC-AS1US false
77.67.63.231
 unknown Germany
3257 GTT-BACKBONEGTTDE false
144.124.148.177
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
78.211.212.29
 unknown France
12322 PROXADFR false
212.135.206.254
 unknown United Kingdom
4589 EASYNETEasynetGlobalServicesEU false
101.182.144.68
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
116.104.47.218
 unknown Viet Nam
24086 VIETTEL-AS-VNViettelCorporationVN false
159.114.249.109
 unknown United Kingdom
32982 DOE-HQUS false
43.78.4.239
 unknown Japan 4249 LILLY-ASUS false
220.234.178.130
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
88.143.248.115
 unknown France
8228 CEGETEL-ASFR false
147.187.117.9
 unknown United States
63039 USMOASNUS false
66.0.112.211
 unknown United States
7029 WINDSTREAMUS false
158.169.254.157
 unknown Luxembourg
42848 EC-ASLU false
191.242.141.226
 unknown Brazil
262730 BytewebComunicacaoMultimidiaLtdaBR false
90.192.174.0
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
114.87.152.200
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
198.73.224.223
 unknown United States
19855 MASERGYUS false
154.73.89.108
 unknown South Sudan
37406 RCSSS false
40.183.20.29
 unknown United States
4249 LILLY-ASUS false
103.75.115.190
 unknown China
133041 TIANXINGROUP-AS-APTianxinGroupCoLimitedHK false
218.177.66.152
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
188.65.123.191
 unknown France
41690 DAILYMOTIONForpeeringrelatedbusinesspleasemailpeerin false
152.160.245.178
 unknown United States
54163 AHOSTINGUS false
107.195.173.224
 unknown United States
7018 ATT-INTERNET4US false
43.110.113.74
 unknown Japan 4249 LILLY-ASUS false
171.176.165.237
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
170.224.130.3
 unknown United States
11685 HNBCOL-ASUS false
135.1.165.76
 unknown United States
10455 LUCENT-CIOUS false
81.255.86.140
 unknown France
3215 FranceTelecom-OrangeFR false
103.169.22.73
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
202.155.217.209
 unknown Hong Kong
9381 HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK false
74.32.182.143
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
172.171.26.238
 unknown United States
7018 ATT-INTERNET4US false
97.160.170.244
 unknown United States
6167 CELLCO-PARTUS false
41.227.43.11
 unknown Tunisia
2609 TN-BB-ASTunisiaBackBoneASTN false
204.219.74.130
 unknown United States
6595 DODDSEURDE false
9.193.186.221
 unknown United States
3356 LEVEL3US false
113.35.237.13
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
60.174.151.86
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
219.176.161.107
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
64.69.134.5
 unknown United States
53862 MCDANIELCOLLEGEUS false
122.4.123.192
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
88.132.94.7
 unknown Hungary
35311 PR-TELECOM-ASHU false
4.98.147.176
 unknown United States
3356 LEVEL3US false
196.143.151.25
 unknown Egypt
36935 Vodafone-EG false
208.187.168.228
 unknown United States
16578 DATANOCUS false
66.171.26.183
 unknown United States
33339 NEMONT-CELLULARUS false
194.168.237.211
 unknown United Kingdom
5089 NTLGB false
199.255.119.29
 unknown Puerto Rico
46941 XAIRNET-CORPPR false
99.108.133.106
 unknown United States
7018 ATT-INTERNET4US false
90.18.247.132
 unknown France
3215 FranceTelecom-OrangeFR false
86.27.49.66
 unknown United Kingdom
5089 NTLGB false
171.128.174.101
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
137.186.184.156
 unknown Canada
852 ASN852CA false
209.111.81.177
 unknown United States
5006 VOYANTUS false
105.26.231.236
 unknown Mauritius
37100 SEACOM-ASMU false
152.187.134.111
 unknown United States
701 UUNETUS false
93.210.14.141
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
17.237.253.141
 unknown United States
714 APPLE-ENGINEERINGUS false
139.176.251.73
 unknown China
8968 BT-ITALIAIT false
62.31.100.60
 unknown United Kingdom
5089 NTLGB false
32.22.246.59
 unknown United States
2686 ATGS-MMD-ASUS false
148.11.87.107
 unknown United States
394673 9408US false
1.13.172.28
 unknown China
13335 CLOUDFLARENETUS false
89.11.228.59
 unknown Norway
15659 NEXTGENTELNEXTGENTELAutonomousSystemNO false
82.167.56.133
 unknown Saudi Arabia
35753 ITCITCASnumberSA false
27.193.150.172
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
125.247.125.247
 unknown Korea Republic of
38402 GOESW-AS-KRGyeonggiProvincialSuwonOfficeofEducationK false
17.131.192.141
 unknown United States
714 APPLE-ENGINEERINGUS false
117.147.55.218
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false

Contacted Domains

Name IP Active
byte-mirai.kro.kr 154.216.20.119 true