Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527300
MD5:	f4ceea6be2ae4ed6a2cdb4dae78d97ff
SHA1:	cd31d196975edf2d0fd39c257b9fab2240d7a69a
SHA256:	6fa06e0cea4a02eeb601de420ef0e70c056f5dbd8c6b32df824c051c6a224435
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527300
Start date and time:	2024-10-06 22:25:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/100@1/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: na.elf

Process Tree

system is lnxubuntu20

na.elf (PID: 5423, Parent: 5347, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5425, Parent: 5423)

na.elf New Fork (PID: 5426, Parent: 5423)

na.elf New Fork (PID: 5427, Parent: 5423)

na.elf New Fork (PID: 5430, Parent: 5427)

na.elf New Fork (PID: 5436, Parent: 5427)

na.elf New Fork (PID: 5439, Parent: 5427)

na.elf New Fork (PID: 5441, Parent: 5427)

na.elf New Fork (PID: 5443, Parent: 5427)

gdm3 New Fork (PID: 5478, Parent: 1400)

Default (PID: 5478, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5481, Parent: 1)

dbus-daemon (PID: 5481, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5482, Parent: 2935)

pulseaudio (PID: 5482, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5483, Parent: 1)

rsyslogd (PID: 5483, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 5484, Parent: 1400)

Default (PID: 5484, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5485, Parent: 1400)

Default (PID: 5485, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gvfsd-fuse New Fork (PID: 5486, Parent: 3122)

fusermount (PID: 5486, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5495, Parent: 1)

rtkit-daemon (PID: 5495, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5498, Parent: 1)

systemd-logind (PID: 5498, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5557, Parent: 1)

polkitd (PID: 5557, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5563, Parent: 1)

gpu-manager (PID: 5563, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5564, Parent: 5563)

sh (PID: 5564, Parent: 5563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5565, Parent: 5564)

grep (PID: 5565, Parent: 5564, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5567, Parent: 5563)

sh (PID: 5567, Parent: 5563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5568, Parent: 5567)

grep (PID: 5568, Parent: 5567, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5569, Parent: 5563)

sh (PID: 5569, Parent: 5563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5570, Parent: 5569)

grep (PID: 5570, Parent: 5569, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5571, Parent: 5563)

sh (PID: 5571, Parent: 5563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5572, Parent: 5571)

grep (PID: 5572, Parent: 5571, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5573, Parent: 5563)

sh (PID: 5573, Parent: 5563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5574, Parent: 5573)

grep (PID: 5574, Parent: 5573, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5575, Parent: 5563)

sh (PID: 5575, Parent: 5563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5576, Parent: 5575)

grep (PID: 5576, Parent: 5575, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5577, Parent: 5563)

sh (PID: 5577, Parent: 5563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5578, Parent: 5577)

grep (PID: 5578, Parent: 5577, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5579, Parent: 5563)

sh (PID: 5579, Parent: 5563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5580, Parent: 5579)

grep (PID: 5580, Parent: 5579, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5566, Parent: 1)

agetty (PID: 5566, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5585, Parent: 1)

generate-config (PID: 5585, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5586, Parent: 5585)

pkill (PID: 5586, Parent: 5585, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5587, Parent: 1)

gdm-wait-for-drm (PID: 5587, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5592, Parent: 1)

gdm3 (PID: 5592, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5596, Parent: 5592)

plymouth (PID: 5596, Parent: 5592, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5615, Parent: 5592)

gdm-session-worker (PID: 5615, Parent: 5592, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5619, Parent: 5615)

gdm-wayland-session (PID: 5619, Parent: 5615, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5625, Parent: 5619)

dbus-run-session (PID: 5625, Parent: 5619, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5626, Parent: 5625)

dbus-daemon (PID: 5626, Parent: 5625, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5630, Parent: 5626)

dbus-daemon New Fork (PID: 5631, Parent: 5630)

false (PID: 5631, Parent: 5630, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5633, Parent: 5626)

dbus-daemon New Fork (PID: 5634, Parent: 5633)

false (PID: 5634, Parent: 5633, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5635, Parent: 5626)

dbus-daemon New Fork (PID: 5636, Parent: 5635)

false (PID: 5636, Parent: 5635, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5637, Parent: 5626)

dbus-daemon New Fork (PID: 5638, Parent: 5637)

false (PID: 5638, Parent: 5637, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5639, Parent: 5626)

dbus-daemon New Fork (PID: 5640, Parent: 5639)

false (PID: 5640, Parent: 5639, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5641, Parent: 5626)

dbus-daemon New Fork (PID: 5642, Parent: 5641)

false (PID: 5642, Parent: 5641, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5644, Parent: 5626)

dbus-daemon New Fork (PID: 5645, Parent: 5644)

false (PID: 5645, Parent: 5644, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5627, Parent: 5625)

gnome-session (PID: 5627, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5627, Parent: 5625, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5646, Parent: 5627)

session-migration (PID: 5646, Parent: 5627, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5647, Parent: 5627)

sh (PID: 5647, Parent: 5627, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5647, Parent: 5627, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5674, Parent: 5592)

gdm-session-worker (PID: 5674, Parent: 5592, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5686, Parent: 5674)

gdm-x-session (PID: 5686, Parent: 5674, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5690, Parent: 5686)

Xorg (PID: 5690, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5690, Parent: 5686, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5690, Parent: 5686, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5699, Parent: 5690)

sh (PID: 5699, Parent: 5690, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5700, Parent: 5699)

xkbcomp (PID: 5700, Parent: 5699, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 5948, Parent: 5690)

sh (PID: 5948, Parent: 5690, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5949, Parent: 5948)

xkbcomp (PID: 5949, Parent: 5948, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5705, Parent: 5686)

Default (PID: 5705, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5706, Parent: 5686)

dbus-run-session (PID: 5706, Parent: 5686, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5707, Parent: 5706)

dbus-daemon (PID: 5707, Parent: 5706, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5723, Parent: 5707)

dbus-daemon New Fork (PID: 5724, Parent: 5723)

at-spi-bus-launcher (PID: 5724, Parent: 5723, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5729, Parent: 5724)

dbus-daemon (PID: 5729, Parent: 5724, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6104, Parent: 5729)

dbus-daemon New Fork (PID: 6105, Parent: 6104)

at-spi2-registryd (PID: 6105, Parent: 6104, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5751, Parent: 5707)

dbus-daemon New Fork (PID: 5752, Parent: 5751)

false (PID: 5752, Parent: 5751, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5754, Parent: 5707)

dbus-daemon New Fork (PID: 5755, Parent: 5754)

false (PID: 5755, Parent: 5754, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5756, Parent: 5707)

dbus-daemon New Fork (PID: 5757, Parent: 5756)

false (PID: 5757, Parent: 5756, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5760, Parent: 5707)

dbus-daemon New Fork (PID: 5761, Parent: 5760)

false (PID: 5761, Parent: 5760, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5762, Parent: 5707)

dbus-daemon New Fork (PID: 5763, Parent: 5762)

false (PID: 5763, Parent: 5762, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5764, Parent: 5707)

dbus-daemon New Fork (PID: 5765, Parent: 5764)

false (PID: 5765, Parent: 5764, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5767, Parent: 5707)

dbus-daemon New Fork (PID: 5768, Parent: 5767)

false (PID: 5768, Parent: 5767, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5946, Parent: 5707)

dbus-daemon New Fork (PID: 5947, Parent: 5946)

ibus-portal (PID: 5947, Parent: 5946, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6125, Parent: 5707)

dbus-daemon New Fork (PID: 6126, Parent: 6125)

gjs (PID: 6126, Parent: 6125, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6338, Parent: 5707)

dbus-daemon New Fork (PID: 6340, Parent: 6338)

false (PID: 6340, Parent: 6338, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5708, Parent: 5706)

gnome-session (PID: 5708, Parent: 5706, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5708, Parent: 5706, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5711, Parent: 5708)

gnome-session-check-accelerated (PID: 5711, Parent: 5708, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5730, Parent: 5711)

gnome-session-check-accelerated-gl-helper (PID: 5730, Parent: 5711, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5740, Parent: 5711)

gnome-session-check-accelerated-gles-helper (PID: 5740, Parent: 5711, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5769, Parent: 5708)

session-migration (PID: 5769, Parent: 5708, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5770, Parent: 5708)

sh (PID: 5770, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5770, Parent: 5708, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5871, Parent: 5770)

ibus-daemon (PID: 5871, Parent: 5770, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 5942, Parent: 5871)

ibus-memconf (PID: 5942, Parent: 5871, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 5944, Parent: 5871)

ibus-daemon New Fork (PID: 5945, Parent: 5944)

ibus-x11 (PID: 5945, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6168, Parent: 5871)

ibus-engine-simple (PID: 6168, Parent: 5871, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6142, Parent: 5708)

sh (PID: 6142, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6142, Parent: 5708, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6144, Parent: 5708)

sh (PID: 6144, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6144, Parent: 5708, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6146, Parent: 5708)

sh (PID: 6146, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6146, Parent: 5708, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6147, Parent: 5708)

sh (PID: 6147, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6147, Parent: 5708, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6148, Parent: 5708)

sh (PID: 6148, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6148, Parent: 5708, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6339, Parent: 6148)

gsd-print-notifications New Fork (PID: 6341, Parent: 6339)

gsd-printer (PID: 6341, Parent: 6339, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6149, Parent: 5708)

sh (PID: 6149, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6149, Parent: 5708, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6151, Parent: 5708)

sh (PID: 6151, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6151, Parent: 5708, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6152, Parent: 5708)

sh (PID: 6152, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6152, Parent: 5708, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6153, Parent: 5708)

sh (PID: 6153, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6153, Parent: 5708, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6154, Parent: 5708)

sh (PID: 6154, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6154, Parent: 5708, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6157, Parent: 5708)

sh (PID: 6157, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6157, Parent: 5708, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6163, Parent: 5708)

sh (PID: 6163, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6163, Parent: 5708, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6167, Parent: 5708)

sh (PID: 6167, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6167, Parent: 5708, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6170, Parent: 5708)

sh (PID: 6170, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6170, Parent: 5708, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6573, Parent: 5708)

sh (PID: 6573, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6573, Parent: 5708, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6583, Parent: 5708)

sh (PID: 6583, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6583, Parent: 5708, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5675, Parent: 5592)

Default (PID: 5675, Parent: 5592, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5676, Parent: 5592)

Default (PID: 5676, Parent: 5592, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5598, Parent: 1)

accounts-daemon (PID: 5598, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5608, Parent: 5598)

language-validate (PID: 5608, Parent: 5598, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5609, Parent: 5608)

language-options (PID: 5609, Parent: 5608, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5610, Parent: 5609)

sh (PID: 5610, Parent: 5609, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5611, Parent: 5610)

locale (PID: 5611, Parent: 5610, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5612, Parent: 5610)

grep (PID: 5612, Parent: 5610, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5621, Parent: 1410)

dbus-daemon (PID: 5621, Parent: 1410, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5792, Parent: 1)

systemd-localed (PID: 5792, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 5956, Parent: 1)

upowerd (PID: 5956, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 5994, Parent: 1410)

pulseaudio (PID: 5994, Parent: 1410, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5999, Parent: 1)

geoclue (PID: 5999, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6114, Parent: 1)

wpa_supplicant (PID: 6114, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6116, Parent: 2935)

dbus-daemon (PID: 6116, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6117, Parent: 1)

avahi-daemon (PID: 6117, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6119, Parent: 6117)

systemd New Fork (PID: 6121, Parent: 1)

packagekitd (PID: 6121, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6141, Parent: 6121)

dpkg (PID: 6141, Parent: 6121, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6132, Parent: 2935)

pulseaudio (PID: 6132, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6191, Parent: 1)

systemd-hostnamed (PID: 6191, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6374, Parent: 1)

ModemManager (PID: 6374, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6423, Parent: 1)

colord (PID: 6423, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6578, Parent: 6423)

colord-sane (PID: 6578, Parent: 6423, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6431, Parent: 1)

systemd-localed (PID: 6431, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6598, Parent: 1)

fprintd (PID: 6598, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5423	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5423	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5425	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5425	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5426	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5426	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5427	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5427	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5430	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5430	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5436	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5436	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 19 entries

String: N^Nubyte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpcurl/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: global traffic

TCP traffic: 192.168.2.13:37400 -> 154.216.20.119:777

Source: /usr/sbin/rsyslogd (PID: 5483)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5592)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5626)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5627)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5707)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5729)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5708)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5871)	Socket: unknown address family

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 19.60.231.10
Source: unknown	TCP traffic detected without corresponding DNS query: 207.173.151.10
Source: unknown	TCP traffic detected without corresponding DNS query: 50.182.140.9
Source: unknown	TCP traffic detected without corresponding DNS query: 34.21.67.159
Source: unknown	TCP traffic detected without corresponding DNS query: 139.187.21.89
Source: unknown	TCP traffic detected without corresponding DNS query: 190.134.17.103
Source: unknown	TCP traffic detected without corresponding DNS query: 201.192.154.128
Source: unknown	TCP traffic detected without corresponding DNS query: 68.185.250.187
Source: unknown	TCP traffic detected without corresponding DNS query: 13.220.25.231
Source: unknown	TCP traffic detected without corresponding DNS query: 179.184.64.115
Source: unknown	TCP traffic detected without corresponding DNS query: 77.222.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 8.225.246.80
Source: unknown	TCP traffic detected without corresponding DNS query: 60.158.124.252
Source: unknown	TCP traffic detected without corresponding DNS query: 63.181.246.193
Source: unknown	TCP traffic detected without corresponding DNS query: 191.202.89.201
Source: unknown	TCP traffic detected without corresponding DNS query: 175.31.121.34
Source: unknown	TCP traffic detected without corresponding DNS query: 14.147.91.181
Source: unknown	TCP traffic detected without corresponding DNS query: 143.42.216.231
Source: unknown	TCP traffic detected without corresponding DNS query: 83.224.70.146
Source: unknown	TCP traffic detected without corresponding DNS query: 42.106.83.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.236.170.223
Source: unknown	TCP traffic detected without corresponding DNS query: 118.132.54.74
Source: unknown	TCP traffic detected without corresponding DNS query: 182.225.221.77
Source: unknown	TCP traffic detected without corresponding DNS query: 212.52.0.112
Source: unknown	TCP traffic detected without corresponding DNS query: 220.168.179.145
Source: unknown	TCP traffic detected without corresponding DNS query: 68.75.88.237
Source: unknown	TCP traffic detected without corresponding DNS query: 193.170.208.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.21.202.142
Source: unknown	TCP traffic detected without corresponding DNS query: 212.33.173.36
Source: unknown	TCP traffic detected without corresponding DNS query: 130.114.211.106
Source: unknown	TCP traffic detected without corresponding DNS query: 101.32.80.214
Source: unknown	TCP traffic detected without corresponding DNS query: 64.196.4.150
Source: unknown	TCP traffic detected without corresponding DNS query: 124.80.55.172
Source: unknown	TCP traffic detected without corresponding DNS query: 126.150.75.61
Source: unknown	TCP traffic detected without corresponding DNS query: 172.172.57.134
Source: unknown	TCP traffic detected without corresponding DNS query: 86.154.215.162
Source: unknown	TCP traffic detected without corresponding DNS query: 122.91.79.60
Source: unknown	TCP traffic detected without corresponding DNS query: 166.133.75.179
Source: unknown	TCP traffic detected without corresponding DNS query: 58.132.32.230
Source: unknown	TCP traffic detected without corresponding DNS query: 183.48.243.221
Source: unknown	TCP traffic detected without corresponding DNS query: 124.236.83.167
Source: unknown	TCP traffic detected without corresponding DNS query: 163.230.209.6
Source: unknown	TCP traffic detected without corresponding DNS query: 186.71.7.95
Source: unknown	TCP traffic detected without corresponding DNS query: 79.85.35.8
Source: unknown	TCP traffic detected without corresponding DNS query: 100.254.90.20
Source: unknown	TCP traffic detected without corresponding DNS query: 106.43.87.92
Source: unknown	TCP traffic detected without corresponding DNS query: 90.34.248.61
Source: unknown	TCP traffic detected without corresponding DNS query: 45.232.32.173
Source: unknown	TCP traffic detected without corresponding DNS query: 47.237.98.241
Source: unknown	TCP traffic detected without corresponding DNS query: 150.202.213.95

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: syslog.26.dr, Xorg.0.log.149.dr	String found in binary or memory: http://wiki.x.org
Source: syslog.26.dr, Xorg.0.log.149.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.26.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3712, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 5407, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 5425, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3712, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 5427, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 5430, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5707)	SIGKILL sent: pid: 5723, result: successful
Source: /usr/bin/dbus-daemon (PID: 5707)	SIGKILL sent: pid: 5946, result: successful
Source: /usr/bin/dbus-daemon (PID: 5707)	SIGKILL sent: pid: 6125, result: successful
Source: /usr/bin/dbus-daemon (PID: 5729)	SIGKILL sent: pid: 6104, result: successful

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: N^Nubyte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpcurl/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 3712, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 5407, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5425)	SIGKILL sent: pid: 5425, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 3712, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 5427, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	SIGKILL sent: pid: 5430, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5707)	SIGKILL sent: pid: 5723, result: successful
Source: /usr/bin/dbus-daemon (PID: 5707)	SIGKILL sent: pid: 5946, result: successful
Source: /usr/bin/dbus-daemon (PID: 5707)	SIGKILL sent: pid: 6125, result: successful
Source: /usr/bin/dbus-daemon (PID: 5729)	SIGKILL sent: pid: 6104, result: successful

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/100@1/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5481)	File: /proc/5481/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5486)	File: /proc/5486/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5626)	File: /proc/5626/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5707)	File: /proc/5707/mounts
Source: /usr/bin/dbus-daemon (PID: 5729)	File: /proc/5729/mounts
Source: /usr/bin/gjs (PID: 6126)	File: /proc/6126/mounts
Source: /usr/bin/gnome-shell (PID: 5770)	File: /proc/5770/mounts
Source: /usr/bin/dbus-daemon (PID: 5621)	File: /proc/5621/mounts
Source: /usr/bin/dbus-daemon (PID: 6116)	File: /proc/6116/mounts

Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0lczUtX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#12735aB7T	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127qlsbhV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1Bv606W	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127SBljFX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0wrsKvV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127sLJRrU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1uo1PVW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1MneO4T	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127xykiMX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0kTR4KW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1Rq5OdU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127IOV4PT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1R3Lb3T	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1GAD4dV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c1EgYguU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127A7YetV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0ssUUOX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127Z7FW4T	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0qVyVCX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127UnD19W	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0o48q5T	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127Iyp7fW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2JFu0eV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#127Yfq1fX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/seats/.#seat0Njj6ZU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c28pv7aX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c20EhCSW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/users/.#1275KRIlW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2y2QSzX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c21LkI5X	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2q2utUX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c26Q9cQU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/sessions/.#c2gOKhDV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/inhibit/.#12u1eDV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/inhibit/.#2GDtJoU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/inhibit/.#3eaWt7X	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5498)	File: /run/systemd/inhibit/.#4JVsO5X	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5557)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5647)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5647)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5690)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5730)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5770)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5770)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5770)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5770)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5770)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5770)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5770)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 5945)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 5945)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6144)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6144)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6146)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6146)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6147)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6147)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6149)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6149)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6170)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6170)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 5956)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 5956)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6121)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6191)	Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6374)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6374)	Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6423)	Directory: /var/lib/colord/.cache

Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5481/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5481/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6153/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5482/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5482/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5482/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6132/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6132/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6374/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6431/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5686/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6114/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6598/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6191/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6170/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5619/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6149/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6149/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5557/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5999/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5999/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5615/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5615/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5956/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5690/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6142/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5592/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5495/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5770/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5792/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6121/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6121/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6341/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6146/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5498/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5674/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5674/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6148/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6423/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5994/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5994/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5994/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5598/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6147/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5708/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6117/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/6578/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5647/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5481)	File opened: /proc/5627/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/5264/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5430)	File opened: /proc/248/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5564)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5567)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5569)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5571)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5573)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5575)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5577)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5579)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5699)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 5948)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5610)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5565)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5568)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5570)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5572)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5574)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5576)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5578)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5580)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5612)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5586)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5566)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5592)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5592)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5483)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5483)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5563)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5690)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5563)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690)	Truncated file: /var/log/Xorg.pid-5690.log

Source: /usr/bin/pulseaudio (PID: 5482)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5586)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5730)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5770)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5994)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6132)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/na.elf (PID: 5423)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5482)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5563)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5566)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5615)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5627)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5674)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5686)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5690)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5724)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6105)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5708)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5711)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5730)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5740)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5770)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 5945)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6144)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6146)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6147)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6151)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6153)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6170)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5994)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6117)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6121)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6132)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6191)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6578)	Queries kernel information via 'uname':

Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.816] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.169] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.237] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.890] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.222] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.714] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.968] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.686] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.610] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.073] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.591] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.203] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.847] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.378] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.364] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.177] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.grn: 8
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.638] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.320] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.735] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.543] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.991] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.517] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.011] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.506] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.942] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.333] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.091] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.108] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.575] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.540] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.969] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.502] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.587] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.094] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.285] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.853] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.216] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.758] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.258] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 153.433] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.035] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.458] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.414] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.959] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.142] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.919] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.903] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.914] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.273] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.342] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.161] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.227] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.373] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.270] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.536] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.183] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.627] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.387] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.804] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.731] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.479] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.275] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.461] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.635] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 153.481] (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.867] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.815] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.437] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.209] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.238] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.957] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.207] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.939] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.547] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) LoadModule: "vmware"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.622] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.919] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.923] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.700] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 157.292] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.614] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.525] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: na.elf, 5423.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5425.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5426.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5427.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5430.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5436.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.974] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.759] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.976] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.714] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.551] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): bpp: 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.934] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.049] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.510] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.706] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.646] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.118] (--) vmware(0): mheig: 885
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.191] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.690] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.373] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.482] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.736] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.744] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.562] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.944] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.513] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.964] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.775] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.248] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): vis: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.909] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.354] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.104] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.521] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.042] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.888] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.109] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.990] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.409] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.469] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.726] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.311] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.868] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.351] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.829] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.440] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): RGB weight 888
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): pbase: 0xe8000000
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.441] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.395] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.764] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.230] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.259] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.153] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.899] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.197] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.713] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.263] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.794] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.465] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.573] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 157.310] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.985] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.872] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.763] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.929] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.684] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.355] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.234] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.123] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.492] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.245] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.448] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.170] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.267] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.587] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.858] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.949] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.293] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.747] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.374] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.424] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.419] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.404] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): mwidt: 1176
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.052] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.586] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.018] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.360] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.753] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.286] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.581] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.152] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.165] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.387] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.383] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.488] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.266] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.255] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: na.elf, 5425.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.Wn0gnn
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.566] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.598] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.809] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.344] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.741] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.114] (--) vmware(0): mwidt: 1176
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Using HW cursor
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.454] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.129] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.665] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.378] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.517] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.000] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.188] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: na.elf, 5423.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5425.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5426.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5427.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5430.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp, na.elf, 5436.1.00005591bc1aa000.00005591bc22f000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.731] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.513] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.302] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.710] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.842] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 153.414] (II) LoadModule: "vmware"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.480] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.655] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.792] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.083] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.428] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.433] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.484] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: na.elf, 5423.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5425.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5426.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5427.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5430.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp, na.elf, 5436.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.752] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.873] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.499] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.096] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.149] (--) vmware(0): vis: 4
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.450] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.659] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.615] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.085] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.383] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.736] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.521] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: na.elf, 5430.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.mglKoN
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.251] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.495] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.363] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.763] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.863] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.315] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.527] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.879] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.820] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 157.301] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.346] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.863] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.369] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.884] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.473] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.034] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.785] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.656] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.954] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.242] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.463] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.328] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.547] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.557] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 157.250] (EE) vmware(0): Failed to open drm.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.769] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.178] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.674] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.632] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.099] (--) vmware(0): bpp: 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.595] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.281] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.538] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.139] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.474] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.321] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.619] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.979] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.160] (==) vmware(0): RGB weight 888
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:03 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.559] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.453] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.073] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 153.634] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.400] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.945] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.605] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.701] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.476] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.277] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.298] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.472] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.420] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 153.393] (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.636] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.695] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.641] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.532] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.695] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.144] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.570] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 153.751] (II) vmware(0): Creating default Display subsection in Screen section
Source: na.elf, 5430.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.mglKoN
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.555] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: na.elf, 5425.1.00007ffe7e368000.00007ffe7e389000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.Wn0gnn
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.549] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.413] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.443] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): vram: 4194304
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.561] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.528] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.719] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.780] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 165.776] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.564] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.782] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.600] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:07 galassia /usr/lib/gdm3/gdm-x-session[5690]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.426] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.604] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.133] (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.837] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.216] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): mheig: 885
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:10 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.848] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.119] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:11 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.129] (--) vmware(0): bpp: 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:08 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.671] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.645] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.838] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 158.681] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:09 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.773] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.528] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:27:15 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5598)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5423, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5425, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5427, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5430, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5436, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5423, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5425, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5427, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5430, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5436, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5423, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5425, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5427, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5430, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5436, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5430.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5427.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5425.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5423.1.00007ff4c8001000.00007ff4c8013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5423, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5425, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5427, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5430, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5436, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	75%	ReversingLabs	Linux.Trojan.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.26.dr	false	unknown
http://wiki.x.org	syslog.26.dr, Xorg.0.log.149.dr	false	unknown
http://www.ubuntu.com/support)	syslog.26.dr, Xorg.0.log.149.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
53.189.202.204	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
177.107.116.96	unknown	Brazil	53065	OpcaoTelecomBR	false
159.182.65.118	unknown	United States	9823	NCS-PEARSON-AS-APEducationWebHostingAU	false
119.189.17.175	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
137.146.160.13	unknown	United States	6056	COLBYUS	false
85.218.82.205	unknown	Switzerland	34781	SIL-CITYCABLE-ASCH	false
210.235.243.196	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
69.166.39.47	unknown	United States	393564	SPOKANEUS	false
94.25.27.73	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
204.30.100.159	unknown	United States	3356	LEVEL3US	false
196.158.82.219	unknown	Egypt	36935	Vodafone-EG	false
66.157.249.129	unknown	United States	7018	ATT-INTERNET4US	false
161.31.26.185	unknown	United States	40581	AREON-ASUS	false
84.139.209.153	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
49.228.126.124	unknown	Thailand	133481	AIS-FIBRE-AS-APAISFibreTH	false
197.90.198.156	unknown	South Africa	10474	OPTINETZA	false
95.7.215.185	unknown	Turkey	9121	TTNETTR	false
89.205.31.171	unknown	Macedonia	41557	TELEKABEL-ASMK	false
169.153.233.5	unknown	United States	7867	TECHDATAUS	false
79.85.35.8	unknown	France	15557	LDCOMNETFR	false
12.224.246.67	unknown	United States	7018	ATT-INTERNET4US	false
169.119.23.39	unknown	United States	37611	AfrihostZA	false
149.118.255.206	unknown	United States	188	SAIC-ASUS	false
179.18.249.94	unknown	Colombia	22698	AVANTELSASCO	false
129.91.29.93	unknown	United States	63295	ORCL-CHICAGO1US	false
118.68.42.183	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
133.235.6.84	unknown	Japan	7682	HOTNETHOKKAIDOTELECOMMUNICATIONSNETWORKCoIncJP	false
133.119.10.98	unknown	Japan	2522	PPP-EXPJapanNetworkInformationCenterJP	false
34.199.141.141	unknown	United States	14618	AMAZON-AESUS	false
164.52.64.123	unknown	China	63199	CDSC-AS1US	false
77.67.63.231	unknown	Germany	3257	GTT-BACKBONEGTTDE	false
144.124.148.177	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
78.211.212.29	unknown	France	12322	PROXADFR	false
212.135.206.254	unknown	United Kingdom	4589	EASYNETEasynetGlobalServicesEU	false
101.182.144.68	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
116.104.47.218	unknown	Viet Nam	24086	VIETTEL-AS-VNViettelCorporationVN	false
159.114.249.109	unknown	United Kingdom	32982	DOE-HQUS	false
43.78.4.239	unknown	Japan	4249	LILLY-ASUS	false
220.234.178.130	unknown	China	9812	CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN	false
88.143.248.115	unknown	France	8228	CEGETEL-ASFR	false
147.187.117.9	unknown	United States	63039	USMOASNUS	false
66.0.112.211	unknown	United States	7029	WINDSTREAMUS	false
158.169.254.157	unknown	Luxembourg	42848	EC-ASLU	false
191.242.141.226	unknown	Brazil	262730	BytewebComunicacaoMultimidiaLtdaBR	false
90.192.174.0	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
114.87.152.200	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
198.73.224.223	unknown	United States	19855	MASERGYUS	false
154.73.89.108	unknown	South Sudan	37406	RCSSS	false
40.183.20.29	unknown	United States	4249	LILLY-ASUS	false
103.75.115.190	unknown	China	133041	TIANXINGROUP-AS-APTianxinGroupCoLimitedHK	false
218.177.66.152	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
188.65.123.191	unknown	France	41690	DAILYMOTIONForpeeringrelatedbusinesspleasemailpeerin	false
152.160.245.178	unknown	United States	54163	AHOSTINGUS	false
107.195.173.224	unknown	United States	7018	ATT-INTERNET4US	false
43.110.113.74	unknown	Japan	4249	LILLY-ASUS	false
171.176.165.237	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
170.224.130.3	unknown	United States	11685	HNBCOL-ASUS	false
135.1.165.76	unknown	United States	10455	LUCENT-CIOUS	false
81.255.86.140	unknown	France	3215	FranceTelecom-OrangeFR	false
103.169.22.73	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
202.155.217.209	unknown	Hong Kong	9381	HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK	false
74.32.182.143	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
172.171.26.238	unknown	United States	7018	ATT-INTERNET4US	false
97.160.170.244	unknown	United States	6167	CELLCO-PARTUS	false
41.227.43.11	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	false
204.219.74.130	unknown	United States	6595	DODDSEURDE	false
9.193.186.221	unknown	United States	3356	LEVEL3US	false
113.35.237.13	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
60.174.151.86	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
219.176.161.107	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
64.69.134.5	unknown	United States	53862	MCDANIELCOLLEGEUS	false
122.4.123.192	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
88.132.94.7	unknown	Hungary	35311	PR-TELECOM-ASHU	false
4.98.147.176	unknown	United States	3356	LEVEL3US	false
196.143.151.25	unknown	Egypt	36935	Vodafone-EG	false
208.187.168.228	unknown	United States	16578	DATANOCUS	false
66.171.26.183	unknown	United States	33339	NEMONT-CELLULARUS	false
194.168.237.211	unknown	United Kingdom	5089	NTLGB	false
199.255.119.29	unknown	Puerto Rico	46941	XAIRNET-CORPPR	false
99.108.133.106	unknown	United States	7018	ATT-INTERNET4US	false
90.18.247.132	unknown	France	3215	FranceTelecom-OrangeFR	false
86.27.49.66	unknown	United Kingdom	5089	NTLGB	false
171.128.174.101	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
137.186.184.156	unknown	Canada	852	ASN852CA	false
209.111.81.177	unknown	United States	5006	VOYANTUS	false
105.26.231.236	unknown	Mauritius	37100	SEACOM-ASMU	false
152.187.134.111	unknown	United States	701	UUNETUS	false
93.210.14.141	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
17.237.253.141	unknown	United States	714	APPLE-ENGINEERINGUS	false
139.176.251.73	unknown	China	8968	BT-ITALIAIT	false
62.31.100.60	unknown	United Kingdom	5089	NTLGB	false
32.22.246.59	unknown	United States	2686	ATGS-MMD-ASUS	false
148.11.87.107	unknown	United States	394673	9408US	false
1.13.172.28	unknown	China	13335	CLOUDFLARENETUS	false
89.11.228.59	unknown	Norway	15659	NEXTGENTELNEXTGENTELAutonomousSystemNO	false
82.167.56.133	unknown	Saudi Arabia	35753	ITCITCASnumberSA	false
27.193.150.172	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
125.247.125.247	unknown	Korea Republic of	38402	GOESW-AS-KRGyeonggiProvincialSuwonOfficeofEducationK	false
17.131.192.141	unknown	United States	714	APPLE-ENGINEERINGUS	false
117.147.55.218	unknown	China	56041	CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
177.107.116.96	SB1PGkjhA9	Get hash	malicious	Mirai	Browse
196.158.82.219	HEkMILuJTB	Get hash	malicious	Unknown	Browse
161.31.26.185	2T9ShVKj85.elf	Get hash	malicious	Mirai	Browse
84.139.209.153	8wtth5HzS2.elf	Get hash	malicious	Mirai	Browse
49.228.126.124	Q08dqv9CHC.elf	Get hash	malicious	Mirai	Browse
197.90.198.156	Ares.x86.elf	Get hash	malicious	Unknown	Browse
	pxOIIVDOaB.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86	Get hash	malicious	Mirai	Browse
	18vaq1Ah2l	Get hash	malicious	Mirai	Browse
159.182.65.118	boat.arm	Get hash	malicious	Mirai	Browse
137.146.160.13	Wq14C1Wb8i	Get hash	malicious	Mirai	Browse
137.146.160.13	0WEX4JsTIL	Get hash	malicious	Mirai	Browse
85.218.82.205	BpSsm2RxvM.elf	Get hash	malicious	Mirai	Browse
210.235.243.196	sora.arm.elf	Get hash	malicious	Mirai	Browse
210.235.243.196	s4ebcoiVg8	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-mirai.kro.kr	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OpcaoTelecomBR	YzP1CRQ7HF.elf	Get hash	malicious	Unknown	Browse	177.107.116.71
	bLjDNQ7nb4.elf	Get hash	malicious	Mirai	Browse	177.107.116.73
	F1RjUTITQN.elf	Get hash	malicious	Mirai, Okiru	Browse	177.107.116.73
	k3arm7.elf	Get hash	malicious	Mirai	Browse	177.107.116.69
	RdBKbRSLCG.elf	Get hash	malicious	Mirai	Browse	177.107.116.61
	M4RT212KUw.elf	Get hash	malicious	Mirai	Browse	177.107.116.67
	bNiiDULq5V.elf	Get hash	malicious	Mirai	Browse	177.107.116.93
	arm.elf	Get hash	malicious	Mirai	Browse	177.107.116.95
	arm.elf	Get hash	malicious	Mirai	Browse	187.86.49.101
	Cdsw5EQWa4.elf	Get hash	malicious	Mirai	Browse	177.107.116.86
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	na.elf	Get hash	malicious	Mirai, Okiru	Browse	120.129.72.148
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	113.236.166.136
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	110.17.77.118
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	113.58.178.63
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	150.255.2.86
	na.elf	Get hash	malicious	Mirai	Browse	101.16.254.250
	na.elf	Get hash	malicious	Mirai	Browse	116.142.180.201
	na.elf	Get hash	malicious	Mirai	Browse	116.151.162.124
	na.elf	Get hash	malicious	Mirai	Browse	122.140.130.223
	na.elf	Get hash	malicious	Mirai	Browse	39.68.236.211
NCS-PEARSON-AS-APEducationWebHostingAU	vkGOmuEY6o.elf	Get hash	malicious	Mirai, Moobot	Browse	159.182.100.144
	fJBq0o8bfe.elf	Get hash	malicious	Gafgyt	Browse	168.146.122.156
	Ky1NOWkHjt.elf	Get hash	malicious	Unknown	Browse	159.182.65.119
	x86-20231016-0010.elf	Get hash	malicious	Mirai	Browse	159.182.65.123
	iiYtbZ0OeZ.elf	Get hash	malicious	Mirai	Browse	159.182.65.134
	oL8VQ1PTrk.elf	Get hash	malicious	Mirai	Browse	159.182.65.121
	npIyScktbW.elf	Get hash	malicious	Mirai	Browse	168.146.114.240
	sora.x86.elf	Get hash	malicious	Mirai	Browse	168.146.114.239
	dlR3M062Fu.elf	Get hash	malicious	Mirai	Browse	168.146.114.246
	bEJ7OMHN1k.elf	Get hash	malicious	Mirai, Moobot	Browse	159.182.65.106
DAIMLER-ASITIGNGlobalNetworkDE	na.elf	Get hash	malicious	Mirai, Okiru	Browse	53.187.32.119
	na.elf	Get hash	malicious	Mirai	Browse	53.176.97.169
	na.elf	Get hash	malicious	Mirai	Browse	53.246.15.85
	na.elf	Get hash	malicious	Mirai	Browse	53.2.133.121
	na.elf	Get hash	malicious	Mirai	Browse	53.146.168.39
	na.elf	Get hash	malicious	Mirai	Browse	53.23.52.64
	na.elf	Get hash	malicious	Mirai	Browse	53.183.175.204
	z3hir.arm.elf	Get hash	malicious	Mirai	Browse	53.210.84.105
	arm-20241006-0950.elf	Get hash	malicious	Mirai	Browse	53.238.80.175
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	53.94.145.196

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5631/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5634/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5636/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5638/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5640/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5642/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5645/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5724/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5752/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5755/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5757/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5761/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5763/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5765/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5768/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5947/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6105/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6126/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6340/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:5cn:u
MD5:	9DA4A0454E877512140F6B2DBC5A947E
SHA1:	CD1D38491CA07F2C68E31C949F46B932F029043B
SHA-256:	7F7F94F26D23F7ACA80A33732161AF068F9F62FBE0E824A58CF3A39D209CFA77
SHA-512:	750E076A97D070B97B726E92ECA0310BBAFCCBC8F35B126305B6EC7722E586B384207639EF6B809BF8911463167CBA595FBE683B59E7E397BD18F3B3962A3085
Malicious:	false
Preview:	6117.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Fc/:q
MD5:	2E83C1D539906E96D97F8B1EC1184FC4
SHA1:	AE4054E23301ED7F5BFDD2C0D7FE9938BA4E2641
SHA-256:	1C7F12284169E4E6E0976F769BE222EDACB8D47A5CDD3BC0C7CD56F852FE98E2
SHA-512:	0F3B9712466BEF81EEC72C8E5E74232FC5A337C6E1EDE1DE721852F311175D81AF8D702498680A769481F98E3A8C6C81E7422AAE1982456C29F5CBEB2E1F3D9F
Malicious:	false
Preview:	5592.

/run/systemd/inhibit/.#12u1eDV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifMW0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApf8ApLHK7wR9n
MD5:	F08C08724EEF499938931EA14DC4D629
SHA1:	47AF165769DF3E5B478EC1295439731889977EB7
SHA-256:	2E2458C487BB79E9D17309B6AB62722C60C24D66706DD9907869743B73632C42
SHA-512:	49E0FA249DAEF56B79DE2DB6CA51B124BDB8538C5D91DB1F98E07C1FF6EAB09AE2E2491B4D2AF0DDE9955DF3BD89AFA7637C35D66799FB378A923E3CF288DF66
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5956.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2GDtJoU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.2194016554059095
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+nLqKLXv0Rsz:qgFqXQXTI1IlyqKjcRsz
MD5:	CF5AB1671D35DCD61D4084DA47C904C5
SHA1:	A247413AD1E72CA4503156D1408D93029767A787
SHA-256:	8508C5F95429630AECD65F709FABF35ED297883B656EDD9E64C4BEA7CBBB4D0B
SHA-512:	06BF8EC315848A44A854764E73E413C95ABB5F26A3712AE60CF077E72B1BEFA729015598D9D61A636390EE8A9F8CA9C9637DBE9E3FC0BEF10BB541742F780FF0
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6153.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3eaWt7X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++YvVfiXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+nLqKLXv0RT
MD5:	3B0EE2914D2159472E845A2A769738CA
SHA1:	F2DA995150DF241BCDD3B029F67F3704F1D04485
SHA-256:	24A6072D44320D0127650D4CCBAFC1592E27D80AF6EE01615937EFE6AADD4EDC
SHA-512:	CD768CE37D853EE75CB24991CE91221F697D00B6195B8C9D2AEE8632DA67A23558C95AF05F9A7A31815FD403BB8E88C41BB0CC1F7E6F9751AED3FFF7E1444D0B
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6153.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4JVsO5X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.152041866447974
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++hqiiXulpv5RX8/SflY:SbFuFyL8OAAx+CFlpLRS
MD5:	05AA91EA158F4A34011DA726257D4F44
SHA1:	0201DEF224C64684D22BAFB1CBBDBF05079E8567
SHA-256:	0045F14735251091D2C7E664001FA99FEB5B67E98DDE09E8355CBACFD35BECAF
SHA-512:	25F0CC497A9235A05108D2144CF751B9884DC67D3FEC01B447FD5621734A0D1B43EF00C4AF9C3DEBBAD484200C2FA1A61FBDD7E586AA61217DAEED9996824AFC
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6170.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/seats/.#seat0Njj6ZU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0kTR4KW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0lczUtX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0o48q5T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0qVyVCX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0ssUUOX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0wrsKvV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/sessions/.#c1Bv606W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.504675143345494
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedVuRmUKBhcIS3xffLHxfx2xNIByy6GBK7JgjPD2s:qgFqPumVuRZI4BD9x2xayWK7Jg+s
MD5:	1AC3E7760D2465776286787A6B1E0A5D
SHA1:	1AD4F9DD876D4CB6DF794DB1402EAEB53A7A810D
SHA-256:	0F3E926600663CA5CFC59A9B0225324DAFD9DE2DDF835A752C330A37519EC77A
SHA-512:	206644D6AA322F2710743A12CB3C9A8A81C2AAE7D7DD3EC2BF8F1FAC218B47A56DC73CC534994501E6CCC48BBCAE2F2661744B4C10CA710C7D3FF71433312BB5
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7747.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246405912853.MONOTONIC=135696807.

/run/systemd/sessions/.#c1EgYguU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.401203828255469
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBK7JgjPD2s:qgFqPuFdDJIi9x2xayWK7Jg+s
MD5:	F9054F09B14603EA660507A31A54793B
SHA1:	6AD4CB8B7C8F6795125E8EDECE8C749F77F9CEAB
SHA-256:	9107223A6A3CE20BC70F7A4E94E91CEBA7EB824246275D4A99E6E95308D6E4E7
SHA-512:	DCAD905C382C1F457887DD8A4D8E539BAD3F70131C38AE473EF3F9742B827DF1A58FEDC358F1B9C4C1CDCB78FD1EA1C72AA20A17C0221961F68E831B4E726539
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246405912853.MONOTONIC=135696807.

/run/systemd/sessions/.#c1GAD4dV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.442186057732626
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK7JgjPD2s:qgFqPuFN6IG0n99x2xayWK7Jg+s
MD5:	52544ECCDBA3E87023F1B65E94FE4E9C
SHA1:	602CC33D2B9BD835EED89A1A7498FF599562FE70
SHA-256:	4CD1859882CF9E118EBD98A8FD02772B28F6EE83087DCFA7F44DB5141FA97D41
SHA-512:	29DBC5AC17BC3ECA934DB4D97ED6396823436F0A6FCA520143B47FEEABE90C28214EBFD39795522F54C00585786EAB8A5995372FC5D2663AA26082EB2FFCEAF5
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246405912853.MONOTONIC=135696807.

/run/systemd/sessions/.#c1MneO4T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.443249734960962
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBK7JgjPD2s:qgFqPumW8IG0n99x2xayWK7Jg+s
MD5:	0D7766C7835ED3C3F16EED468F685909
SHA1:	5C290F2B99625D7641CD9D0B3F119C5FD6A31A71
SHA-256:	B18A9A6A95B0617ECB1CE78E8C8B5E53756C24558112CD9FAEE8F67D46FA17D5
SHA-512:	A6FBEC1DBDA67FB1897429D3D4864CEFF01DFF5C21DE1B923F9965B58033382E66C89B3DA4374E1BB1283EF3D14C175824694E423BF09FED9A710846661CA848
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246405912853.MONOTONIC=135696807.

/run/systemd/sessions/.#c1R3Lb3T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.452645349585355
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK7JgjPD2HqN:qgFqPuFN6IG0n99x2xayWK7Jg+HqN
MD5:	8A972D37C65CB7485A65769B38445EC6
SHA1:	771BA506A8B9B91B897BC27C431B99690F87DB84
SHA-256:	2C16870E0A3576E482A3EBE5028EC37B24B0D5DDE46A009DF5D2B858456755BC
SHA-512:	A3B7BF0B798E4979F5BA7FC52B69FA2E2DC2EDF7457DC1620903F245C8DFDC6E6A587879EC330B4A8BA8A36697051B22EE911C9CAFE141FF0E3C2EF302D42C34
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246405912853.MONOTONIC=135696807.CONTROLLER=:1.13.

/run/systemd/sessions/.#c1Rq5OdU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.442186057732626
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK7JgjPD2s:qgFqPuFN6IG0n99x2xayWK7Jg+s
MD5:	52544ECCDBA3E87023F1B65E94FE4E9C
SHA1:	602CC33D2B9BD835EED89A1A7498FF599562FE70
SHA-256:	4CD1859882CF9E118EBD98A8FD02772B28F6EE83087DCFA7F44DB5141FA97D41
SHA-512:	29DBC5AC17BC3ECA934DB4D97ED6396823436F0A6FCA520143B47FEEABE90C28214EBFD39795522F54C00585786EAB8A5995372FC5D2663AA26082EB2FFCEAF5
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246405912853.MONOTONIC=135696807.

/run/systemd/sessions/.#c1uo1PVW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.443249734960962
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBK7JgjPD2s:qgFqPumW8IG0n99x2xayWK7Jg+s
MD5:	0D7766C7835ED3C3F16EED468F685909
SHA1:	5C290F2B99625D7641CD9D0B3F119C5FD6A31A71
SHA-256:	B18A9A6A95B0617ECB1CE78E8C8B5E53756C24558112CD9FAEE8F67D46FA17D5
SHA-512:	A6FBEC1DBDA67FB1897429D3D4864CEFF01DFF5C21DE1B923F9965B58033382E66C89B3DA4374E1BB1283EF3D14C175824694E423BF09FED9A710846661CA848
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5615.REALTIME=1728246405912853.MONOTONIC=135696807.

/run/systemd/sessions/.#c20EhCSW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.421716515704471
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKHgxJgWlGg6:qgFqPuFNuCH0nI9x2xayWKHCgW4l
MD5:	C35606FC2D5CF4BA507EA7B18F3B0438
SHA1:	3B0A2D0AFFBD917599F8AD52A01900C8563DB504
SHA-256:	6B5DD500C91ED74D59BE9E2344B6AC94301888971CC119EC10706123349380AF
SHA-512:	A60B53A85CF7DA63DE519C02E6AF56389F9313F6133C00422A04787B13F0B5F91C2F0924E1702A5FFDC06927D07EE75FE3BEB2087DEA7EEB3DADE6B0ED0C6D7F
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5674.REALTIME=1728246419209150.MONOTONIC=148993104.

/run/systemd/sessions/.#c21LkI5X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.437531993402267
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKHgxJgWlGgg:qgFqPuFNuCH0nI9x2xayWKHCgW43
MD5:	15CDB2461727DDB614DC676A917F407C
SHA1:	4B94E8FCE79BD81F5CEA75D6CE61F80380A4378E
SHA-256:	49D01EB1155594407CD2748BD997EA1C66C2E109CC2A1EC4AFB8CB173E097158
SHA-512:	CAFA942DAE9F6B1349616BE8D1ABF6BE925333B0986CADC109E129E199A5490FC594E70DD44EFD2C8D20F6BBE10ACF0CE6288C59CB6ADA30B35BD9A36E8145BA
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5674.REALTIME=1728246419209150.MONOTONIC=148993104.CONTROLLER=:1.17.DEVICES=13:64 .

/run/systemd/sessions/.#c26Q9cQU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.460798374492009
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKHgxJgWlGg1k:qgFqPuFNuCH0nI9x2xayWKHCgW4Mk
MD5:	A31E17E179A6FCF5E0FF01942E2CD368
SHA1:	3FBD99785B015C4FCD77749BE66D0AF8DFE6EBFC
SHA-256:	441641BB38816BC76FBB963E901E7D213FDAD9F07D8F6A0994F0BDD5538F248B
SHA-512:	620541943DB395C34DBCCBF888DF6D1D9F1139085287023463E58DBC93D6599B4DF7D6055162C4FF0559288047EBE0F510FAEBE73CC20054CC38C0926EB30805
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5674.REALTIME=1728246419209150.MONOTONIC=148993104.CONTROLLER=:1.17.DEVICES=13:65 13:67 13:64 .

/run/systemd/sessions/.#c28pv7aX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.421716515704471
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKHgxJgWlGg6:qgFqPuFNuCH0nI9x2xayWKHCgW4l
MD5:	C35606FC2D5CF4BA507EA7B18F3B0438
SHA1:	3B0A2D0AFFBD917599F8AD52A01900C8563DB504
SHA-256:	6B5DD500C91ED74D59BE9E2344B6AC94301888971CC119EC10706123349380AF
SHA-512:	A60B53A85CF7DA63DE519C02E6AF56389F9313F6133C00422A04787B13F0B5F91C2F0924E1702A5FFDC06927D07EE75FE3BEB2087DEA7EEB3DADE6B0ED0C6D7F
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5674.REALTIME=1728246419209150.MONOTONIC=148993104.

/run/systemd/sessions/.#c2JFu0eV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.47275597326461
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffC5hBxfx2xNIByy6GBKHgxJgWlGg6:qgFqPuFVuRpCvBKB9x2xayWKHCgW4l
MD5:	250054F717F5CC3D1FF02C1F0D778A3E
SHA1:	4E295E54E1926A6DAC898CBF60BDCE337C17A3B6
SHA-256:	6BD07C11D8D0C991273A05D5B32D66945DC80ECBF8114B37881480FF38A45F40
SHA-512:	3810964B85C73E3F05570700822AD3D0A941B3A07F933A3AABEE9AA24B5AE03B30F4E6402F70127EFB68518EA329C30E74A61CC794517700626900EDF069C347
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7810.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5674.REALTIME=1728246419209150.MONOTONIC=148993104.

/run/systemd/sessions/.#c2gOKhDV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.464260707817774
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKHgxJgWlGg1i:qgFqPuFNuCH0nI9x2xayWKHCgW4Mi
MD5:	10A5CB853250040B44884DA117330E8C
SHA1:	ED1E47F0B714AA188FDDC954E105C50FCAD0845B
SHA-256:	39B81EFA6B0869FE340BF2404E07DBB886802D41E303860DC0D0F6E8FD1F207A
SHA-512:	3459FBBA4FB8F7198F08D904E65FA5331ADADC3586DD49F1C8273D69E851ECC3B4C5E4260BB80CDA0F0998446B384671E63F395AED6059C0E1229B4C16EC051E
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5674.REALTIME=1728246419209150.MONOTONIC=148993104.CONTROLLER=:1.17.DEVICES=13:65 13:67 13:66 13:64 .

/run/systemd/sessions/.#c2q2utUX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.452607266975266
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKHgxJgWlGg13:qgFqPuFNuCH0nI9x2xayWKHCgW4M3
MD5:	1F2BA9F3EC4FA1A5713ACF2583AF66E7
SHA1:	F40D1F0DAA3FF88D3746F86265D05AB45B73EA50
SHA-256:	D6005EB1BCC8E0A1AC58B38B5233888338BDD39056DBCA9E6FD7A5A6F9A6B879
SHA-512:	F379687E96E6B98F4805672699ECFE36AABCD7831082D05AECD73D576B98397B04022E43767FFC8B56287821E175D9AAD99415E2CA6361DCF6B3AB41BF05C40F
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5674.REALTIME=1728246419209150.MONOTONIC=148993104.CONTROLLER=:1.17.DEVICES=13:65 13:64 .

/run/systemd/sessions/.#c2y2QSzX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.430285152023994
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKHgxJgWlGgA:qgFqPuFNuCH0nI9x2xayWKHCgW41
MD5:	4841AEA6815E96F008330CD52F93CAA3
SHA1:	238BE45C6BAC54AB65575E4307D169B91C0A16AC
SHA-256:	533C5D578D882184C9CF0CEC7E15EB2E20DC4C23D49DB5EAB62D5B4B93A8844D
SHA-512:	96263391DC9EBA9AE081CADECB07A89776AE54A43F03469FB254250121C222CEEB3351B15FC04F9B188B86A1BAB33B38586B6F0D105EC50E679C46C1EAF9B923
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5674.REALTIME=1728246419209150.MONOTONIC=148993104.CONTROLLER=:1.17.

/run/systemd/users/.#12735aB7T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1275KRIlW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.177210582155685
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgjdgriR12z5c2zw02zb2owB:qgFq30NzL/ixxTghgriGz5HzwPzbA
MD5:	CA494F353945BDB8A7D33CF97EE3868E
SHA1:	092763C7FEDFC9861029BCD8CA0A16F2BF720B6E
SHA-256:	9C22FC1F59DA240A239FDB65066A529EB315C678AA9D351389656D56A14FC333
SHA-512:	37D4FD134EEC1814D52DB4351556EC348DB954E9F26828F9B3F69C926C68F2D6A13D566E371FAB62E4C2C6BBCF0E3BFE1ED25D621EBF41C90D5AE6999584E80E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127A7YetV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.197070500265738
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgjdgriR12thQc2x9sS02nmD2owC:qgFq30dAL/ixeghgriGthQHxbPnmDd
MD5:	320C7473A954C94412499EE264719B52
SHA1:	567D5F46DF25DC4B9D60F80716E797F7118A0F16
SHA-256:	E663B83D12F63F8C514A1636D39D2EDCCB36A5B3DEC8B05B1E94FC5213E6986B
SHA-512:	A0A2283F22C01AEA2803BEDABC7927539BB0C798132DAEE650797C01D467509AED9C77AC99958EBAFF3B43A41FDD396FF63E4F791950034C6FCA4C52CABD01A4
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127IOV4PT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.181606610234411
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgjdgriR12thQc2x9sS02/g2owB:qgFq30NzL/ixeghgriGthQHxbPYA
MD5:	2CD01597F6392B0216E0CFAAD3576557
SHA1:	E9FF5E22D5C85DD60F79D4E94DE31EC751745A0A
SHA-256:	EEE78340756A5D7A3DC6F50D3464249382AF669167C2BAC014A7F1BD79704148
SHA-512:	C2E4699C2BBE28D599143061D60F16D9DADB1A76B9C0377A57FCA26F1F4650E0735FAF6D608809F1E847F003F586DF22520C4BB93176419E4AE7C363F4723FA6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Iyp7fW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.1727018548595645
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgjdgriR12z5c2zw02zb2owB:qgFq30z1cL/iRJghgriGz5HzwPzbA
MD5:	C01EB54449D9260FE36559CAE63B38FE
SHA1:	C1242E75B98D9FFA430C553792D1B3C18895147A
SHA-256:	836314C412DC5E9DD1EBC053F993BBD658A4523C281EDDFF707A08AC1597B103
SHA-512:	CF8B0C164287FAB5A7C1523E3EFE300B527A51E856E82860864FC66B3238F8B52707D1A0C33EEF21343533A481296D0E2DC83A8622DF7062D382C78CA3503F18
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127SBljFX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.341755280462394
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffMQzSfgjdgriR12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBUQzeghgriGthQHtP0
MD5:	293FD94ADC4F7221268AD55BDBA6E3E2
SHA1:	44E90F1B4E8F93ECB44D0B0E815294AAD0EE6142
SHA-256:	47B94C17C945B6C95D235CC3F18A99811AF24EFB27DE6BBC58998A7D62715835
SHA-512:	A7437896010B4BFCC3D5D303FFD066A5040A35E488585E0A2DEB0E300DD6BA810D606BF515AA35B6ED0F6BD45A57616378CAA2CD2591C39F5175CD330B963231
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7685.DISPLAY=c1.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127UnD19W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.180394389224778
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgjdgriR12thQc2pb02nmD2p9rwC:qgFq30dAL/ixeghgriGthQHtPnmDq9x
MD5:	4405D36FC4160BDBF31924879324A858
SHA1:	A8EC693EB6AAD224163CAB92D072C13B15CC047E
SHA-256:	7BFE387F9A62DFCC44313E8B92C333CB89DF09C2D513A65121FBB8A26393D615
SHA-512:	6B708DED7C4BC3143C81062F7048B815E969B13191216727B625D19792F03C98FFFA501CA44CF1FFFA942FA81A8D9C3386AA74B81CD4311CCB07B82180FBD1AA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127Yfq1fX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.193146837135766
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgjdgriR12z5c2zw02zb2owB:qgFq30z1cL/ixxTghgriGz5HzwPzbA
MD5:	5F91F3AEB34E87EDF76D10FEC70F076B
SHA1:	E3A9510A9488FE828591F5A832AB2E247A0C5B53
SHA-256:	D9F7D82DA7ADCF32D4605BBA83BF95FE2C77915D2D572E8DB6C11C8F3291E73A
SHA-512:	189210C59CBFE7B612907994C5EE26CFFDEA7E60F3A18C96202767661E42F88CD2C82D22502CF5BA11008D788CE371BD6FEDD3DC772AA7509154EA1480C307ED
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Z7FW4T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.180394389224778
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgjdgriR12thQc2pb02nmD2p9rwC:qgFq30dAL/ixeghgriGthQHtPnmDq9x
MD5:	4405D36FC4160BDBF31924879324A858
SHA1:	A8EC693EB6AAD224163CAB92D072C13B15CC047E
SHA-256:	7BFE387F9A62DFCC44313E8B92C333CB89DF09C2D513A65121FBB8A26393D615
SHA-512:	6B708DED7C4BC3143C81062F7048B815E969B13191216727B625D19792F03C98FFFA501CA44CF1FFFA942FA81A8D9C3386AA74B81CD4311CCB07B82180FBD1AA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127qlsbhV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.320342090058701
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffMG5JgjdgriR12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBUEJghgriGthQHtPYb
MD5:	53D24E3CCE97A9E55CBD44C8590FB941
SHA1:	813AECB52CA5E603878D64F573CEAAEFC6523148
SHA-256:	4398C35949843B561872E38DEA5301C047E44B7C88278D1FF0335A8615D8CBDD
SHA-512:	7D53DAFA6BECF3C8996C81A98857ADB7EA4314F5B2C846202AAF4ED8B422797C92C403097C7D91B6B8A4BC05DC4ED315E1009CF68C22EA54954AB6D08DBF0F9D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7685.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sLJRrU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.187634978763958
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgjdgriR12thQc2pb02/g2p9rwB:qgFq30z1cL/ixeghgriGthQHtPYq9M
MD5:	009873D8353EC9C1F0F68F659850D109
SHA1:	972E3BB69AEB36A1B9E78B4409C45F2AF28E4C7B
SHA-256:	EC714B81596481F5349B8B6DB0D04A277D8995503D6F992EFD26344E3C037ECB
SHA-512:	44460005D267315D50985EA7E2F8D808F62876D5CAB179A5CC0A294F25DC40AABDD013E0166BA3E8E7BD4D4359BED5D3CF7D8F3DFD4568C2393637483592D3BB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127xykiMX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.187634978763958
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgjdgriR12thQc2pb02/g2p9rwB:qgFq30z1cL/ixeghgriGthQHtPYq9M
MD5:	009873D8353EC9C1F0F68F659850D109
SHA1:	972E3BB69AEB36A1B9E78B4409C45F2AF28E4C7B
SHA-256:	EC714B81596481F5349B8B6DB0D04A277D8995503D6F992EFD26344E3C037ECB
SHA-512:	44460005D267315D50985EA7E2F8D808F62876D5CAB179A5CC0A294F25DC40AABDD013E0166BA3E8E7BD4D4359BED5D3CF7D8F3DFD4568C2393637483592D3BB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246405865432.MONOTONIC=135649386.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:7/:j
MD5:	C13F9B70C7B7623438C9379528ED9F8B
SHA1:	C88D4787B6CC3F465C038A84624AFAAEF023B434
SHA-256:	B623A7982A7C3E69B19B96384F49E47BAF9E961E854483888B5866D0EDAE1CF9
SHA-512:	35EB44CEEF80F960E82D2B3D0B2F72DF12509111CA8F4E2347791E062BAD342179939C966C2CC95167804A265838E21E70485C88F236CFEE54B6C8A04EEFF664
Malicious:	false
Preview:	6132.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.016931324746426
Encrypted:	false
SSDEEP:	12:OxP0FvIOveY+0vsXxPZuq3eveY+ZulxPH+rl9NOveY+H+5AxPu3o3ulveY+u3o3m:tvIphWyetbFZOiZ
MD5:	3FD3DAF2BD9855DD9C4E5668CBEE07C5
SHA1:	0C3E76001652BEF2DACA104FAA3D322408DB38AB
SHA-256:	2703CC7831882B56FAA34DF6E4DF5C5EECB094523A2BDC79134ACF62A2CE44B4
SHA-512:	F4746A1E9B7CEF9037E0EF631CFBAC029444BD11BB9B647D0E50474D9CC72EEFCB59B5C585D1CD1CFA2FF0BFFBFD44E68944AC89723E13CC4594C5474AB135D4
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5708..MIT-MAGIC-COOKIE-1...M.w..S8%.+O..R...XSMP...#local/galassia:@/tmp/.ICE-unix/5708..MIT-MAGIC-COOKIE-1..j.....(....R.\|....ICE...!unix/galassia:/tmp/.ICE-unix/5627..MIT-MAGIC-COOKIE-1..7....YK......;..ICE...#local/galassia:@/tmp/.ICE-unix/5627..MIT-MAGIC-COOKIE-1............=3...XSMP...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....3.16G.\|.Q.......XSMP...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..uoT..;.......%....ICE...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...)....I...b....L..ICE...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1..j...w~q]$M....<...XSMP...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...i...........LE..XSMP...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...e.....-..3$....ICE...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....<..;..6<L.......ICE...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..ad.U~.OxR.c.}..(..XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.959350316086631
Encrypted:	false
SSDEEP:	3:rg/WFllasO93XHViIGhyXlwgWFllasO93XHViIGhy9:rg/WFl2nHIVmlHWFl2nHIV0
MD5:	F1C7A870A1C01EC36CB5469E6331C193
SHA1:	2EF501DD5365096B454D89E123305F11069DF9A8
SHA-256:	E3FFE815BD178F648EE97BFC3F463474948E81D82C492B44C613CEB6C5700BB1
SHA-512:	0ABDF65489C3260812CB9D99605B4953B37115D5BB979E17BA020EF719E1F66CBAD3DA8634D7C229ED2DDCE050A86A0735D8267A1259DB6233CDD767D53A9C7C
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1....aY7u.............galassia....MIT-MAGIC-COOKIE-1....aY7u.........

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:JcJn:Mn
MD5:	C49040BADB58448029F5BA3D174711F5
SHA1:	5BC243076366B8F97EF490F791F3CA2E3B6C3416
SHA-256:	B7A600279AD90EA9DF701DFFF5BC075B872F399B1848784864C18D04E93F76DA
SHA-512:	CB1D7387D52CA2C7F9F41D8AE0B6002C5FE42804F78E8AC6FAC43A85A45552B87AEBFCABA81ADEFA5514812B90CE7C2F884BFB99767AC961FD3CC0FCED71072A
Malicious:	false
Preview:	5994.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6667178117422345
Encrypted:	false
SSDEEP:	3:i0sXlXEWtl/Wy7Kiv:iV+yley7Ki
MD5:	C1EE0DE4CE8EFF745D48D893CEA52F82
SHA1:	275DDCCCBF27A986B851F7641DF688BC0E4AAD69
SHA-256:	DCB6DFC4E6A0ADDCACB1FA5867E02074D660164E943F35DFDC3BC163624067B1
SHA-512:	82291D4F18C04698A9DCCA0A89BB0068524A083B69E6AED0CF6A120E2023AFA87E09CDB504F95BBA3BA7C52F2772F6ACBA4958B310CD285215CB0FCD4AE2B947
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................t..g........................................

/tmp/qemu-open.Wn0gnn (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/qemu-open.mglKoN (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.EUQDV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.VZ1NV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.131371229344367
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWpAFl4AM34W:q5sU3LWfLUDmQymqSFbfomSAn1dfu
MD5:	0B186DDBB0A28E54DA04F2F7F85D28E9
SHA1:	73536C40D4716244D1DC198EB87AD890D2CE5900
SHA-256:	B16D65096022DB74AF81FDBA2FA02B6280151796536727B226A42721693BEDE3
SHA-512:	5196C3A9FB4066CA284675F5B0C8C2B7C556F71FEC262E78CAA486ED7D910061B63B20B5DB0DD6A43863F3C353ED2EC41A008B6F49BFABFF5E8F6DC402A5A37C
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-JJ0MXx3w,guid=09e5c7ff7fc6cd7931eeba7a6702f2bf.IBUS_DAEMON_PID=5871.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.285681507465226
Encrypted:	false
SSDEEP:	384:xYtB2EqpXEgnM/dCdYdMdndgdEd8dtd0d3d9dndGd8d4dIdRdnd4dVdVHdh8dd48:xWB2LZEtmM8etiue6XPVnPply
MD5:	E41FF3BA07264C341071ACFDEABF6DFA
SHA1:	F98BA7F622D59CB043543BB1BF2AE37B549FEE24
SHA-256:	F1D76FA5CA4CC53D1DB288C2CD585D655ACC87DB17D94CE1F6C6A70091DB3305
SHA-512:	3E4439C55A931C991B4969D6FA5BE89F73B076341BC22183695F46BBCEE07CA78B0802E30FDA979388D5319C5B048C4784AB44902582113F119A1B981D7DDC3F
Malicious:	false
Preview:	[ 150.367] (--) Log file renamed from "/var/log/Xorg.pid-5690.log" to "/var/log/Xorg.0.log".[ 150.393] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 150.417] Build Operating System: linux Ubuntu.[ 150.434] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 150.486] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 150.574] Build Date: 06 July 2021 10:17:51AM.[ 150.581] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 150.589] Current version of pixman: 0.38.4.[ 150.602] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 150.610] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2435
Entropy (8bit):	4.976043618366143
Encrypted:	false
SSDEEP:	48:OxZx3/e3/N3/C3/83/T3/o+DSvvDSfVBLDOZrCshKgRk0kZrboCZrCn:OxPvevNvCv8vTvfGvvGfTLDOfRkD1q
MD5:	3B8585FB341B9DBB0343C4F86E61BF49
SHA1:	CB27580953778B2579D6BD3CCBDFFDA5580AE3B1
SHA-256:	18C8DC344BABE75C506D1B62CE1C105C01F0CFBF754311B11C9FE290C698055A
SHA-512:	C9CEC731E33AA85327B7771FCBABCB05701EDAFE7D7F420DB52EC423895DE4A70F903AE910F9991CCCC35959015DA7B762604FABF2F9ABFBCA6D61DC6CEDE1D8
Malicious:	false
Preview:	Oct 6 15:26:18 galassia systemd-logind[800]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Oct 6 15:26:18 galassia systemd-logind[800]: Session c2 logged out. Waiting for processes to exit..Oct 6 15:26:22 galassia systemd-logind[5498]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 6 15:26:22 galassia systemd-logind[5498]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 6 15:26:22 galassia systemd-logind[5498]: User enumeration failed: Invalid argument.Oct 6 15:26:22 galassia systemd-logind[5498]: User of session c2 not known..Oct 6 15:26:22 galassia systemd-logind[5498]: User of session 2 not known..Oct 6 15:26:22 galassia systemd-logind[5498]: Session enumeration failed: No such file or directory.Oct 6 15:26:23 galassia systemd-logind[5498]: Watching system buttons on /dev/input/event0 (Power Button).Oct 6 15:26:23 galassia systemd-logind[5498]: Watching system buttons on /dev/input/event1 (AT Transl

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	42378
Entropy (8bit):	4.7081791690347
Encrypted:	false
SSDEEP:	384:LOPXrxgXTggTg4TgOTg5T9vTC2qywnFCTp:KPX9gjgWgOgMgN97eup
MD5:	89EBD3580837502F142B16DC1913B7EF
SHA1:	78FFDC82587ED0B3F1D83958C2BFC5BDA5810182
SHA-256:	350E568B19F0929CC896AA30D5C24C6C57B38EE90F88DE1C276711170B907DC3
SHA-512:	0190BE287FEA414F23A6AFACA470251098E9E10E0592FB64A174157DC75584AB8F4B1CDED0A2037729BCE4D38F4B4680775A696B1ECCE3DA4289DE62EF23DDD0
Malicious:	false
Preview:	Oct 6 15:26:20 galassia kernel: [ 108.387522] blocking signal 9: 5425 -> 778.Oct 6 15:26:20 galassia kernel: [ 108.973188] blocking signal 9: 5425 -> 936.Oct 6 15:26:20 galassia kernel: [ 109.086939] blocking signal 9: 5425 -> 1400.Oct 6 15:26:20 galassia kernel: [ 109.563647] blocking signal 9: 5425 -> 3069.Oct 6 15:26:20 galassia kernel: [ 109.872612] blocking signal 9: 5425 -> 3132.Oct 6 15:26:20 galassia kernel: [ 110.008005] blocking signal 9: 5430 -> 660.Oct 6 15:26:20 galassia kernel: [ 110.186302] blocking signal 9: 5430 -> 726.Oct 6 15:26:20 galassia kernel: [ 110.296139] blocking signal 9: 5430 -> 778.Oct 6 15:26:20 galassia kernel: [ 110.370791] blocking signal 9: 5430 -> 936.Oct 6 15:26:20 galassia kernel: [ 110.379550] New task spawned: old: (tgid 5483, tid 5483), new (tgid: 5483, tid: 5490).Oct 6 15:26:20 galassia kernel: [ 110.381532] New task spawned: old: (tgid 5483, tid 5483), new (tgid: 5483, tid: 5491).Oct 6 15:26:20 galassia kernel: [ 110.39

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	151323
Entropy (8bit):	5.202827867371363
Encrypted:	false
SSDEEP:	768:KIR0+L22MzxPuFWImUgQY6h/Zu6e1gEEgOgMgN9CsUPixtVmm5toxm5E3NwcYotc:APwF9/bKCsUP8t
MD5:	CB4D0627A8291501D22AB5F8AC78ECC9
SHA1:	338D5C347FDC8BAC8B954464A4B41CCAC9DBA603
SHA-256:	5B7B9B9E5F660C136F44808C2F8CEAE6FE7D07DD883FE2EE8DDA77AEFD997A9D
SHA-512:	EDCF9D9CA2EE64877C7FBBB0AD4A2141517C4A4A2C369CB04A3578FEBFCD0834357A8B7A56B08C6803BDDDB17A1AD85C0F62EF31C1AE914DE8E5F4B0483E4554
Malicious:	false
Preview:	Oct 6 15:26:18 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 6 15:26:18 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 6 15:26:18 galassia systemd[2935]: pulseaudio.service: Scheduled restart job, restart counter is at 1..Oct 6 15:26:18 galassia systemd[2935]: Stopped Sound Service..Oct 6 15:26:18 galassia systemd[2935]: Starting Sound Service....Oct 6 15:26:18 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Oct 6 15:26:18 galassia systemd[1]: Stopped System Logging Service..Oct 6 15:26:18 galassia systemd[1]: Starting System Logging Service....Oct 6 15:26:18 galassia gdm3: GdmLocalDisplayFactory: Failed to issue method call: The connection is closed.Oct 6 15:26:18 galassia systemd[1]: session-c2.scope: Succeeded..Oct 6 15:26:18 galassia systemd[1410]: pulseaudio.service: Succeeded..Oct 6 15:26:19 galassia systemd[1410]: dbus.service: Main process exited, code=killed, s

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6667178117422345
Encrypted:	false
SSDEEP:	3:i0sXlXEWtl/Wy7Kiv:iV+yley7Ki
MD5:	C1EE0DE4CE8EFF745D48D893CEA52F82
SHA1:	275DDCCCBF27A986B851F7641DF688BC0E4AAD69
SHA-256:	DCB6DFC4E6A0ADDCACB1FA5867E02074D660164E943F35DFDC3BC163624067B1
SHA-512:	82291D4F18C04698A9DCCA0A89BB0068524A083B69E6AED0CF6A120E2023AFA87E09CDB504F95BBA3BA7C52F2772F6ACBA4958B310CD285215CB0FCD4AE2B947
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................t..g........................................

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.215763060909237
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	71'336 bytes
MD5:	f4ceea6be2ae4ed6a2cdb4dae78d97ff
SHA1:	cd31d196975edf2d0fd39c257b9fab2240d7a69a
SHA256:	6fa06e0cea4a02eeb601de420ef0e70c056f5dbd8c6b32df824c051c6a224435
SHA512:	0ec896b4d5c4d8a861e821f34c9dec7141d51de67485418959bc924997e9892a2eac9eca6617045f65429c11aef908879c23ff09e5d266bbd5dea291a620391f
SSDEEP:	1536:746u3f4iMCHkuKCAy85aMzj8yJKzZW9Y80ghFbvSFUcSYn:746af1MUkT5aMzzK2YHgnUSi
TLSH:	21633AD6F800DD7EF84EE7BF4463080AB630635006930B3767A7BD97AC721E44966E86
File Content Preview:	.ELF.......................D...4.........4. ...(.................................. ...........0...0.......&,...... .dt.Q............................NV..a....da....(N^NuNV..J9..4.f>"y..0. QJ.g.X.#...0.N."y..0. QJ.f.A.....J.g.Hy....N.X.......4.N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70936
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xfb52	0x0	0x6	AX	4
.fini	PROGBITS	0x8000fbfa	0xfbfa	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000fc08	0xfc08	0x14d6	0x0	0x2	A	2
.ctors	PROGBITS	0x800130e4	0x110e4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x800130ec	0x110ec	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x800130f8	0x110f8	0x3e0	0x0	0x3	WA	4
.bss	NOBITS	0x800134d8	0x114d8	0x2238	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x114d8	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x110de	0x110de	6.2539	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x110e4	0x800130e4	0x800130e4	0x3f4	0x262c	2.7455	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Start time (UTC):	20:26:14
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	20:26:18
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:26:19
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:26:21
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:26:22
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:26:23
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:26:24
Start date (UTC):	06/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:26:25
Start date (UTC):	06/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:26:28
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:26:27
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:26:30
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:26:41
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:26:43
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:26:46
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:26:48
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	20:26:50
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5631/oom_score_adj

/proc/5634/oom_score_adj

/proc/5636/oom_score_adj

/proc/5638/oom_score_adj

/proc/5640/oom_score_adj

/proc/5642/oom_score_adj

/proc/5645/oom_score_adj

/proc/5724/oom_score_adj

/proc/5752/oom_score_adj

/proc/5755/oom_score_adj

/proc/5757/oom_score_adj

/proc/5761/oom_score_adj

/proc/5763/oom_score_adj

/proc/5765/oom_score_adj

/proc/5768/oom_score_adj

/proc/5947/oom_score_adj

/proc/6105/oom_score_adj

/proc/6126/oom_score_adj

/proc/6340/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#12u1eDV

/run/systemd/inhibit/.#2GDtJoU

/run/systemd/inhibit/.#3eaWt7X

/run/systemd/inhibit/.#4JVsO5X

/run/systemd/seats/.#seat0Njj6ZU

Linux Analysis Report
na.elf

Start time (UTC):	20:26:51
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:26:49
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	20:26:52
Start date (UTC):	06/10/2024
Path:	/usr/bin/session-migration
Arguments:	session-migration
File size:	22680 bytes
MD5 hash:	5227af42ebf14ac2fe2acddb002f68dc

Start time (UTC):	20:26:56
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:26:59
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:27:00
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	20:27:11
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:27:44
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:27:17
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	20:27:23
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c