Edit tour

Linux Analysis Report
XvAqhy3FO6.elf

Overview

General Information

Sample name:	XvAqhy3FO6.elf renamed because original name is a hash value
Original sample name:	1b895813a33cd6d036e4b82faed190c2.elf
Analysis ID:	1528330
MD5:	1b895813a33cd6d036e4b82faed190c2
SHA1:	674f2afd17eeaa10f642b4b2a5c47d9d7d2795a5
SHA256:	67965ef52efc331b6ad7a44e99a793c4def5302dd7d63287bae32ebcc568f41a
Tags:	32elfmipsmirai
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528330
Start date and time:	2024-10-07 19:32:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	XvAqhy3FO6.elf renamed because original name is a hash value
Original Sample Name:	1b895813a33cd6d036e4b82faed190c2.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/96@2/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: XvAqhy3FO6.elf

Runtime Messages

Command:	/tmp/XvAqhy3FO6.elf
PID:	5425
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5411, Parent: 3594)

rm (PID: 5411, Parent: 3594, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ZRzIGSnEBc /tmp/tmp.Dw4qdzVmtQ /tmp/tmp.icgmyHceBB

dash New Fork (PID: 5412, Parent: 3594)

rm (PID: 5412, Parent: 3594, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ZRzIGSnEBc /tmp/tmp.Dw4qdzVmtQ /tmp/tmp.icgmyHceBB

XvAqhy3FO6.elf (PID: 5425, Parent: 5349, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/XvAqhy3FO6.elf

XvAqhy3FO6.elf New Fork (PID: 5427, Parent: 5425)

XvAqhy3FO6.elf New Fork (PID: 5428, Parent: 5425)

XvAqhy3FO6.elf New Fork (PID: 5431, Parent: 5425)

XvAqhy3FO6.elf New Fork (PID: 5433, Parent: 5431)

XvAqhy3FO6.elf New Fork (PID: 5440, Parent: 5431)

XvAqhy3FO6.elf New Fork (PID: 5441, Parent: 5431)

XvAqhy3FO6.elf New Fork (PID: 5444, Parent: 5431)

XvAqhy3FO6.elf New Fork (PID: 5448, Parent: 5431)

systemd New Fork (PID: 5485, Parent: 1)

dbus-daemon (PID: 5485, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5486, Parent: 1)

rsyslogd (PID: 5486, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5487, Parent: 2935)

pulseaudio (PID: 5487, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gvfsd-fuse New Fork (PID: 5488, Parent: 3122)

fusermount (PID: 5488, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5498, Parent: 1)

rtkit-daemon (PID: 5498, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5501, Parent: 1)

systemd-logind (PID: 5501, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5562, Parent: 1)

polkitd (PID: 5562, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5566, Parent: 1)

agetty (PID: 5566, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5567, Parent: 1400)

Default (PID: 5567, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5568, Parent: 1400)

Default (PID: 5568, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5569, Parent: 1400)

Default (PID: 5569, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5570, Parent: 1)

gpu-manager (PID: 5570, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5571, Parent: 5570)

sh (PID: 5571, Parent: 5570, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5572, Parent: 5571)

grep (PID: 5572, Parent: 5571, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5573, Parent: 5570)

sh (PID: 5573, Parent: 5570, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5574, Parent: 5573)

grep (PID: 5574, Parent: 5573, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5575, Parent: 5570)

sh (PID: 5575, Parent: 5570, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5576, Parent: 5575)

grep (PID: 5576, Parent: 5575, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5577, Parent: 5570)

sh (PID: 5577, Parent: 5570, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5579, Parent: 5577)

grep (PID: 5579, Parent: 5577, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5580, Parent: 5570)

sh (PID: 5580, Parent: 5570, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5581, Parent: 5580)

grep (PID: 5581, Parent: 5580, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5582, Parent: 5570)

sh (PID: 5582, Parent: 5570, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5583, Parent: 5582)

grep (PID: 5583, Parent: 5582, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5586, Parent: 5570)

sh (PID: 5586, Parent: 5570, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5587, Parent: 5586)

grep (PID: 5587, Parent: 5586, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5590, Parent: 5570)

sh (PID: 5590, Parent: 5570, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5591, Parent: 5590)

grep (PID: 5591, Parent: 5590, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5585, Parent: 2935)

dbus-daemon (PID: 5585, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5593, Parent: 1)

generate-config (PID: 5593, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5603, Parent: 5593)

pkill (PID: 5603, Parent: 5593, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5608, Parent: 1)

gdm-wait-for-drm (PID: 5608, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5613, Parent: 1)

gdm3 (PID: 5613, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5618, Parent: 5613)

plymouth (PID: 5618, Parent: 5613, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5637, Parent: 5613)

gdm-session-worker (PID: 5637, Parent: 5613, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5641, Parent: 5637)

gdm-wayland-session (PID: 5641, Parent: 5637, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5645, Parent: 5641)

dbus-run-session (PID: 5645, Parent: 5641, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5646, Parent: 5645)

dbus-daemon (PID: 5646, Parent: 5645, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5652, Parent: 5646)

dbus-daemon New Fork (PID: 5653, Parent: 5652)

false (PID: 5653, Parent: 5652, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5655, Parent: 5646)

dbus-daemon New Fork (PID: 5656, Parent: 5655)

false (PID: 5656, Parent: 5655, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5657, Parent: 5646)

dbus-daemon New Fork (PID: 5658, Parent: 5657)

false (PID: 5658, Parent: 5657, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5659, Parent: 5646)

dbus-daemon New Fork (PID: 5660, Parent: 5659)

false (PID: 5660, Parent: 5659, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5661, Parent: 5646)

dbus-daemon New Fork (PID: 5662, Parent: 5661)

false (PID: 5662, Parent: 5661, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5663, Parent: 5646)

dbus-daemon New Fork (PID: 5664, Parent: 5663)

false (PID: 5664, Parent: 5663, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5666, Parent: 5646)

dbus-daemon New Fork (PID: 5667, Parent: 5666)

false (PID: 5667, Parent: 5666, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5647, Parent: 5645)

gnome-session (PID: 5647, Parent: 5645, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5647, Parent: 5645, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5668, Parent: 5647)

session-migration (PID: 5668, Parent: 5647, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5669, Parent: 5647)

sh (PID: 5669, Parent: 5647, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5669, Parent: 5647, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5696, Parent: 5613)

gdm-session-worker (PID: 5696, Parent: 5613, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5703, Parent: 5696)

gdm-x-session (PID: 5703, Parent: 5696, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5705, Parent: 5703)

Xorg (PID: 5705, Parent: 5703, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5705, Parent: 5703, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5705, Parent: 5703, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5714, Parent: 5705)

sh (PID: 5714, Parent: 5705, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5715, Parent: 5714)

xkbcomp (PID: 5715, Parent: 5714, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 5962, Parent: 5705)

sh (PID: 5962, Parent: 5705, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5963, Parent: 5962)

xkbcomp (PID: 5963, Parent: 5962, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5720, Parent: 5703)

Default (PID: 5720, Parent: 5703, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5721, Parent: 5703)

dbus-run-session (PID: 5721, Parent: 5703, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5722, Parent: 5721)

dbus-daemon (PID: 5722, Parent: 5721, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5736, Parent: 5722)

dbus-daemon New Fork (PID: 5737, Parent: 5736)

at-spi-bus-launcher (PID: 5737, Parent: 5736, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5742, Parent: 5737)

dbus-daemon (PID: 5742, Parent: 5737, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6133, Parent: 5742)

dbus-daemon New Fork (PID: 6134, Parent: 6133)

at-spi2-registryd (PID: 6134, Parent: 6133, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5766, Parent: 5722)

dbus-daemon New Fork (PID: 5767, Parent: 5766)

false (PID: 5767, Parent: 5766, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5769, Parent: 5722)

dbus-daemon New Fork (PID: 5770, Parent: 5769)

false (PID: 5770, Parent: 5769, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5771, Parent: 5722)

dbus-daemon New Fork (PID: 5772, Parent: 5771)

false (PID: 5772, Parent: 5771, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5773, Parent: 5722)

dbus-daemon New Fork (PID: 5774, Parent: 5773)

false (PID: 5774, Parent: 5773, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5777, Parent: 5722)

dbus-daemon New Fork (PID: 5778, Parent: 5777)

false (PID: 5778, Parent: 5777, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5779, Parent: 5722)

dbus-daemon New Fork (PID: 5780, Parent: 5779)

false (PID: 5780, Parent: 5779, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5782, Parent: 5722)

dbus-daemon New Fork (PID: 5783, Parent: 5782)

false (PID: 5783, Parent: 5782, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5964, Parent: 5722)

dbus-daemon New Fork (PID: 5965, Parent: 5964)

ibus-portal (PID: 5965, Parent: 5964, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6144, Parent: 5722)

dbus-daemon New Fork (PID: 6145, Parent: 6144)

gjs (PID: 6145, Parent: 6144, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6357, Parent: 5722)

dbus-daemon New Fork (PID: 6358, Parent: 6357)

false (PID: 6358, Parent: 6357, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5723, Parent: 5721)

gnome-session (PID: 5723, Parent: 5721, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5723, Parent: 5721, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5724, Parent: 5723)

gnome-session-check-accelerated (PID: 5724, Parent: 5723, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5743, Parent: 5724)

gnome-session-check-accelerated-gl-helper (PID: 5743, Parent: 5724, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5755, Parent: 5724)

gnome-session-check-accelerated-gles-helper (PID: 5755, Parent: 5724, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5784, Parent: 5723)

session-migration (PID: 5784, Parent: 5723, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5785, Parent: 5723)

sh (PID: 5785, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5785, Parent: 5723, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5917, Parent: 5785)

ibus-daemon (PID: 5917, Parent: 5785, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 5958, Parent: 5917)

ibus-memconf (PID: 5958, Parent: 5917, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 5960, Parent: 5917)

ibus-daemon New Fork (PID: 5961, Parent: 5960)

ibus-x11 (PID: 5961, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6180, Parent: 5917)

ibus-engine-simple (PID: 6180, Parent: 5917, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6165, Parent: 5723)

sh (PID: 6165, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6165, Parent: 5723, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6167, Parent: 5723)

sh (PID: 6167, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6167, Parent: 5723, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6169, Parent: 5723)

sh (PID: 6169, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6169, Parent: 5723, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6170, Parent: 5723)

sh (PID: 6170, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6170, Parent: 5723, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6172, Parent: 5723)

sh (PID: 6172, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6172, Parent: 5723, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6389, Parent: 6172)

gsd-print-notifications New Fork (PID: 6390, Parent: 6389)

gsd-printer (PID: 6390, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6173, Parent: 5723)

sh (PID: 6173, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6173, Parent: 5723, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6174, Parent: 5723)

sh (PID: 6174, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6174, Parent: 5723, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6177, Parent: 5723)

sh (PID: 6177, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6177, Parent: 5723, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6178, Parent: 5723)

sh (PID: 6178, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6178, Parent: 5723, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6179, Parent: 5723)

sh (PID: 6179, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6179, Parent: 5723, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6182, Parent: 5723)

sh (PID: 6182, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6182, Parent: 5723, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6185, Parent: 5723)

sh (PID: 6185, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6185, Parent: 5723, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6190, Parent: 5723)

sh (PID: 6190, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6190, Parent: 5723, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6193, Parent: 5723)

sh (PID: 6193, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6193, Parent: 5723, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6624, Parent: 5723)

sh (PID: 6624, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6624, Parent: 5723, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6644, Parent: 5723)

sh (PID: 6644, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6644, Parent: 5723, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5697, Parent: 5613)

Default (PID: 5697, Parent: 5613, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5698, Parent: 5613)

Default (PID: 5698, Parent: 5613, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5619, Parent: 1)

accounts-daemon (PID: 5619, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5630, Parent: 5619)

language-validate (PID: 5630, Parent: 5619, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5631, Parent: 5630)

language-options (PID: 5631, Parent: 5630, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5632, Parent: 5631)

sh (PID: 5632, Parent: 5631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5633, Parent: 5632)

locale (PID: 5633, Parent: 5632, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5634, Parent: 5632)

grep (PID: 5634, Parent: 5632, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5643, Parent: 1410)

dbus-daemon (PID: 5643, Parent: 1410, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5809, Parent: 1)

systemd-localed (PID: 5809, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 5973, Parent: 1)

upowerd (PID: 5973, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6016, Parent: 1410)

pulseaudio (PID: 6016, Parent: 1410, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6026, Parent: 1)

geoclue (PID: 6026, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6141, Parent: 1)

wpa_supplicant (PID: 6141, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6142, Parent: 1)

packagekitd (PID: 6142, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6171, Parent: 6142)

dpkg (PID: 6171, Parent: 6142, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6148, Parent: 1)

avahi-daemon (PID: 6148, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6154, Parent: 6148)

systemd New Fork (PID: 6213, Parent: 1)

systemd-hostnamed (PID: 6213, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6409, Parent: 1)

ModemManager (PID: 6409, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6471, Parent: 1)

colord (PID: 6471, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6626, Parent: 6471)

colord-sane (PID: 6626, Parent: 6471, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6476, Parent: 1)

systemd-localed (PID: 6476, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6645, Parent: 1)

fprintd (PID: 6645, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
XvAqhy3FO6.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
XvAqhy3FO6.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5425.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5425.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5433.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5433.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5431.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5431.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5427.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5427.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5440.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5440.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5428.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5428.1.00007f18f8400000.00007f18f8415000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5425	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5425	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5427	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5427	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5428	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5428	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5431	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5431	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5433	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5433	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5440	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: XvAqhy3FO6.elf PID: 5440	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 19 entries

String: 'byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspctelnetbotdvrHelperbyte-mirai.kro.kr68.183.18.151

Source: global traffic

TCP traffic: 192.168.2.13:45106 -> 154.216.20.119:7777

Source: /usr/sbin/rsyslogd (PID: 5486)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5613)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5646)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5647)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5705)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5722)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5742)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5723)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5917)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.96.204
Source: unknown	TCP traffic detected without corresponding DNS query: 201.71.39.204
Source: unknown	TCP traffic detected without corresponding DNS query: 73.7.34.143
Source: unknown	TCP traffic detected without corresponding DNS query: 165.217.85.209
Source: unknown	TCP traffic detected without corresponding DNS query: 148.201.113.197
Source: unknown	TCP traffic detected without corresponding DNS query: 84.151.55.165
Source: unknown	TCP traffic detected without corresponding DNS query: 152.78.8.179
Source: unknown	TCP traffic detected without corresponding DNS query: 195.190.244.130
Source: unknown	TCP traffic detected without corresponding DNS query: 59.181.157.86
Source: unknown	TCP traffic detected without corresponding DNS query: 118.62.199.232
Source: unknown	TCP traffic detected without corresponding DNS query: 9.91.36.182
Source: unknown	TCP traffic detected without corresponding DNS query: 164.150.105.107
Source: unknown	TCP traffic detected without corresponding DNS query: 177.61.195.182
Source: unknown	TCP traffic detected without corresponding DNS query: 72.147.85.138
Source: unknown	TCP traffic detected without corresponding DNS query: 24.61.180.89
Source: unknown	TCP traffic detected without corresponding DNS query: 186.103.78.165
Source: unknown	TCP traffic detected without corresponding DNS query: 152.86.66.6
Source: unknown	TCP traffic detected without corresponding DNS query: 103.117.165.62
Source: unknown	TCP traffic detected without corresponding DNS query: 94.245.200.161
Source: unknown	TCP traffic detected without corresponding DNS query: 169.21.115.16
Source: unknown	TCP traffic detected without corresponding DNS query: 82.142.238.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.127.109.171
Source: unknown	TCP traffic detected without corresponding DNS query: 149.9.117.14
Source: unknown	TCP traffic detected without corresponding DNS query: 129.164.67.203
Source: unknown	TCP traffic detected without corresponding DNS query: 8.99.67.75
Source: unknown	TCP traffic detected without corresponding DNS query: 47.106.97.52
Source: unknown	TCP traffic detected without corresponding DNS query: 1.37.136.110
Source: unknown	TCP traffic detected without corresponding DNS query: 89.148.170.18
Source: unknown	TCP traffic detected without corresponding DNS query: 138.184.211.40
Source: unknown	TCP traffic detected without corresponding DNS query: 182.113.45.159
Source: unknown	TCP traffic detected without corresponding DNS query: 159.179.132.93
Source: unknown	TCP traffic detected without corresponding DNS query: 102.76.183.34
Source: unknown	TCP traffic detected without corresponding DNS query: 156.52.164.128
Source: unknown	TCP traffic detected without corresponding DNS query: 160.7.253.236
Source: unknown	TCP traffic detected without corresponding DNS query: 59.54.129.150
Source: unknown	TCP traffic detected without corresponding DNS query: 152.184.2.17
Source: unknown	TCP traffic detected without corresponding DNS query: 218.38.227.190
Source: unknown	TCP traffic detected without corresponding DNS query: 171.34.213.95
Source: unknown	TCP traffic detected without corresponding DNS query: 34.185.180.125
Source: unknown	TCP traffic detected without corresponding DNS query: 5.247.117.25
Source: unknown	TCP traffic detected without corresponding DNS query: 18.158.233.130
Source: unknown	TCP traffic detected without corresponding DNS query: 125.25.0.239
Source: unknown	TCP traffic detected without corresponding DNS query: 116.173.7.170
Source: unknown	TCP traffic detected without corresponding DNS query: 155.111.88.133
Source: unknown	TCP traffic detected without corresponding DNS query: 52.146.183.196
Source: unknown	TCP traffic detected without corresponding DNS query: 94.94.204.10
Source: unknown	TCP traffic detected without corresponding DNS query: 85.17.231.88
Source: unknown	TCP traffic detected without corresponding DNS query: 142.242.198.20
Source: unknown	TCP traffic detected without corresponding DNS query: 12.169.144.156
Source: unknown	TCP traffic detected without corresponding DNS query: 1.148.225.64

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: Xorg.0.log.155.dr, syslog.28.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.155.dr, syslog.28.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.28.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3577, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3589, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3675, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 5407, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 5427, result: unknown	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3577, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3589, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3675, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 5431, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 5433, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5722)	SIGKILL sent: pid: 5736, result: successful
Source: /usr/bin/dbus-daemon (PID: 5722)	SIGKILL sent: pid: 5964, result: successful
Source: /usr/bin/dbus-daemon (PID: 5722)	SIGKILL sent: pid: 6144, result: successful
Source: /usr/bin/dbus-daemon (PID: 5742)	SIGKILL sent: pid: 6133, result: successful

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: 'byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspctelnetbotdvrHelperbyte-mirai.kro.kr68.183.18.151

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3577, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3589, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3675, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 3680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 5407, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5427)	SIGKILL sent: pid: 5427, result: unknown	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3577, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3589, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3675, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3676, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3679, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 3680, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 5431, result: successful	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	SIGKILL sent: pid: 5433, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5722)	SIGKILL sent: pid: 5736, result: successful
Source: /usr/bin/dbus-daemon (PID: 5722)	SIGKILL sent: pid: 5964, result: successful
Source: /usr/bin/dbus-daemon (PID: 5722)	SIGKILL sent: pid: 6144, result: successful
Source: /usr/bin/dbus-daemon (PID: 5742)	SIGKILL sent: pid: 6133, result: successful

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/96@2/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5485)	File: /proc/5485/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5488)	File: /proc/5488/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5585)	File: /proc/5585/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5646)	File: /proc/5646/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5722)	File: /proc/5722/mounts
Source: /usr/bin/dbus-daemon (PID: 5742)	File: /proc/5742/mounts
Source: /usr/bin/gjs (PID: 6145)	File: /proc/6145/mounts
Source: /usr/bin/gnome-shell (PID: 5785)	File: /proc/5785/mounts
Source: /usr/bin/dbus-daemon (PID: 5643)	File: /proc/5643/mounts

Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat01wSp9a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127SN1ny9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#1277tbt19	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0SEMGl9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127ys6FY8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c13cyeSa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127k3VwKa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0hgheM7	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127dGGOma	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c1ZzCrZa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c1cpGed9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127p1vNua	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c1MTHNo8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c19sgHJ8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c1syyYka	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127DNXx0a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0hATSTb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#1276aT7R9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat06Sqlkb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127C7vCG8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0d2AJWb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127qxKmZ8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2syw8dc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127VUuj68	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0y1VID9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2a4Aza9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2oYwop9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127Vxuvab	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2YF9z2b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2Utojn9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2QwPlba	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2aHsKd9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2kEBlNb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/inhibit/.#1urFFSa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/inhibit/.#25H78g8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/inhibit/.#3UYGFc9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/inhibit/.#4kGmnV7	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5669)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5669)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5705)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5705)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5724)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5724)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5724)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5743)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5755)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5755)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5755)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5785)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5785)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5785)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5785)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5785)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5785)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5785)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 5961)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 5961)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6167)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6167)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6169)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6169)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6170)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6170)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6173)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6173)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6193)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6193)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5619)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5619)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 5973)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 5973)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6142)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6213)	Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6409)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6409)	Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6471)	Directory: /var/lib/colord/.cache

Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6471/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5485/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5485/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5562/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6476/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6178/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5641/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5487/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5487/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5487/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6016/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6016/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6016/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5785/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6213/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6193/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6170/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6390/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6173/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6173/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6172/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5619/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5973/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6645/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5613/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/2926/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5637/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5637/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6626/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6409/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6142/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6142/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6141/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6165/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5696/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5696/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5498/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6148/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6026/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6026/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/6169/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5501/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5723/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5647/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5669/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5703/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5485)	File opened: /proc/5705/cmdline	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6178/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6178/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5487/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5487/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5487/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6016/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6016/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6016/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5785/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5785/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5785/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5785/cmdline	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5785/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5785/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5785/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6169/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6169/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6193/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6193/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6170/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/6170/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/1/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/1/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5723/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5562)	File opened: /proc/5723/cgroup	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/5266/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/3753/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/XvAqhy3FO6.elf (PID: 5433)	File opened: /proc/17/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5571)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5573)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5575)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5577)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5580)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5582)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5586)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5590)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5714)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 5962)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5632)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5572)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5574)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5576)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5579)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5581)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5583)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5587)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5591)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5634)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5603)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /usr/bin/dash (PID: 5411)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ZRzIGSnEBc /tmp/tmp.Dw4qdzVmtQ /tmp/tmp.icgmyHceBB			Jump to behavior
Source: /usr/bin/dash (PID: 5412)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ZRzIGSnEBc /tmp/tmp.Dw4qdzVmtQ /tmp/tmp.icgmyHceBB			Jump to behavior

Source: /sbin/agetty (PID: 5566)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5613)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5613)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5619)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5619)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5486)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5486)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5570)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5705)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5570)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5705)	Truncated file: /var/log/Xorg.pid-5705.log

Source: /usr/bin/pulseaudio (PID: 5487)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5603)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5705)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5724)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5743)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5755)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5785)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6016)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/XvAqhy3FO6.elf (PID: 5425)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5486)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5487)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5566)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5570)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5637)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5647)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5696)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5703)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5705)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5737)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6134)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5723)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5724)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5743)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5755)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5785)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 5961)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6167)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6169)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6170)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6174)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6178)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6193)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6016)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6142)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6148)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6213)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6626)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6645)	Queries kernel information via 'uname':

Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.319] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.707] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.442] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.637] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.436] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.078] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.706] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.614] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.366] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.518] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.412] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.112] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.718] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.171] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.960] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.717] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.872] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.750] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.287] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.521] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:43 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.455] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.641] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.013] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.427] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: XvAqhy3FO6.elf, 5425.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5427.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5428.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5431.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5433.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5440.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.089] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.294] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.682] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 155.920] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.287] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.669] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.458] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.584] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.451] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.215] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.615] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.370] (--) vmware(0): mheig: 885
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.859] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.422] (--) vmware(0): vis: 4
Source: XvAqhy3FO6.elf, 5425.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5427.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5428.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5431.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5433.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5440.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: Xorg.0.log.155.dr	Binary or memory string: [ 159.248] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.811] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.604] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.554] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.474] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.487] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.806] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.132] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.702] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.508] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.588] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.202] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.579] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.691] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.600] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.518] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: XvAqhy3FO6.elf, 5427.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.XqbNLy
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:54 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.668] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.504] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.610] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.006] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.312] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.186] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): depth: 24
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.732] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.824] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.546] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.118] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.978] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.300] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.387] (--) vmware(0): bpp: 32
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.739] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 159.270] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.508] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.033] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.155.dr	Binary or memory string: [ 153.454] (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.786] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.684] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.916] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:54 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.513] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.998] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.162] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.836] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.748] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.673] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.745] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.313] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (==) vmware(0): Default visual is TrueColor
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 155.893] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.454] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.515] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.711] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.988] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.118] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.416] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.522] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.511] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.226] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.196] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.501] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.163] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.820] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.771] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.598] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.247] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.307] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.598] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.454] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.570] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.706] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.576] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: XvAqhy3FO6.elf, 5425.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5427.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5428.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5431.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5433.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp, XvAqhy3FO6.elf, 5440.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/XvAqhy3FO6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/XvAqhy3FO6.elf
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 155.927] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.220] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.725] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): vram: 4194304
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.495] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.654] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): bpp: 32
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.184] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.401] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.966] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:50 galassia /usr/lib/gdm3/gdm-x-session[5705]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.914] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:50 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.791] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.678] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.038] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.537] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.983] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.084] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.352] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.743] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:43 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.804] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.762] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.846] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:54 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.612] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.563] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.582] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.542] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.051] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.676] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.258] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:54 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.945] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:50 galassia /usr/lib/gdm3/gdm-x-session[5705]: (==) vmware(0): Silken mouse enabled
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.375] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.426] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:50 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.815] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.334] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.562] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.619] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.553] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: XvAqhy3FO6.elf, 5427.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.XqbNLy
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.473] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.176] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.484] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.143] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 159.323] (==) vmware(0): Silken mouse enabled
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.795] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.693] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.441] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.191] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.873] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.071] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.362] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.566] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (==) vmware(0): DPI set to (96, 96)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.711] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.353] (--) vmware(0): pbase: 0xe8000000
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.800] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 153.241] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.371] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.532] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.563] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:43 galassia /usr/lib/gdm3/gdm-x-session[5705]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:43 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) LoadModule: "vmware"
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.107] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.342] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.745] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.881] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.537] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.170] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.595] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.181] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.568] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.461] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.738] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.933] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.734] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.479] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.628] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.213] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.536] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.972] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.446] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.155.dr	Binary or memory string: [ 155.904] (WW) vmware(0): Disabling 3D support.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.502] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.544] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.467] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.765] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.573] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.796] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.687] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.313] (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.664] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.727] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.395] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.608] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.545] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.890] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.964] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:44 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.936] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.328] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.327] (--) vmware(0): depth: 24
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.490] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.142] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.700] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.102] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.476] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.664] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.572] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.207] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.278] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.156] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.253] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.236] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.318] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.386] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.693] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:50 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.553] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.148] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.135] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.481] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.781] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.333] (--) vmware(0): bpp: 32
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.358] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.651] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.589] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 159.263] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (WW) vmware(0): Disabling 3D support.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): vis: 4
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.654] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.530] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 152.788] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.310] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.950] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.781] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): mheig: 885
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 159.330] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.324] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.191] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.073] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.765] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.559] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.751] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.790] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.805] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.769] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.170] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.522] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.540] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: XvAqhy3FO6.elf, 5433.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.PmWGSZ
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.956] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.553] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.407] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.754] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.755] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.992] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.685] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.862] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.441] (==) vmware(0): Default visual is TrueColor
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.696] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.096] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.138] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.408] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.643] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.561] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.702] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.400] (--) vmware(0): w.red: 8
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.757] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.584] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.594] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.713] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (--) vmware(0): mwidt: 1176
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:54 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.378] (--) vmware(0): depth: 24
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.557] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.773] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.242] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 152.706] (II) LoadModule: "vmware"
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.817] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.875] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.062] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: XvAqhy3FO6.elf, 5433.1.00007ffeb598b000.00007ffeb59ac000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.PmWGSZ
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.658] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.605] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.919] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.625] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.156] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.345] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 163.974] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.155.dr	Binary or memory string: [ 164.508] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: XvAqhy3FO6.elf, 5425.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5427.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5428.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5431.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5433.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp, XvAqhy3FO6.elf, 5440.1.000055f2cf5c6000.000055f2cf64d000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.777] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:44 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.855] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.761] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.566] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.527] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.904] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.391] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:55 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.149] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.465] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 152.723] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 158.095] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.621] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.348] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:50 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.155.dr	Binary or memory string: [ 156.458] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:48 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:47 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.717] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.155.dr	Binary or memory string: [ 159.319] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.725] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 7 12:33:49 galassia /usr/lib/gdm3/gdm-x-session[5705]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.155.dr	Binary or memory string: [ 157.127] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5619)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: XvAqhy3FO6.elf, type: SAMPLE
Source: Yara match	File source: 5425.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5427.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5440.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5428.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5425, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5427, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5433, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5440, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: XvAqhy3FO6.elf, type: SAMPLE
Source: Yara match	File source: 5425.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5427.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5440.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5428.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5425, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5427, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5433, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5440, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: XvAqhy3FO6.elf, type: SAMPLE
Source: Yara match	File source: 5425.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5427.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5440.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5428.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5425, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5427, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5433, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5440, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: XvAqhy3FO6.elf, type: SAMPLE
Source: Yara match	File source: 5425.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5427.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5440.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5428.1.00007f18f8400000.00007f18f8415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5425, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5427, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5431, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5433, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XvAqhy3FO6.elf PID: 5440, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
XvAqhy3FO6.elf	58%	ReversingLabs	Linux.Backdoor.Mirai
XvAqhy3FO6.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.28.dr	false	unknown
http://wiki.x.org	Xorg.0.log.155.dr, syslog.28.dr	false	unknown
http://www.ubuntu.com/support)	Xorg.0.log.155.dr, syslog.28.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
138.99.129.41	unknown	Argentina	263768	EUROSATSAAR	false
223.169.120.39	unknown	Korea Republic of	7641	CHINABTNChinaBroadcastingTVNetCN	false
187.255.208.100	unknown	Brazil	28573	CLAROSABR	false
90.69.108.139	unknown	France	12479	UNI2-ASES	false
178.137.157.93	unknown	Ukraine	15895	KSNET-ASUA	false
54.87.50.185	unknown	United States	14618	AMAZON-AESUS	false
110.35.194.76	unknown	Korea Republic of	10175	HCNKUMHO-AS-KRKumhoCableKR	false
164.42.160.97	unknown	Puerto Rico	16649	IUPR-ASPR	false
57.134.190.154	unknown	Belgium	2686	ATGS-MMD-ASUS	false
13.7.15.180	unknown	United States	33631	PARC-ASNUS	false
119.242.158.38	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
172.220.122.192	unknown	United States	20115	CHARTER-20115US	false
140.7.152.248	unknown	United States	668	DNIC-AS-00668US	false
31.57.157.44	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
192.89.10.117	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
210.137.58.174	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
147.166.173.156	unknown	United States	1452	DNIC-ASBLK-01451-01456US	false
196.237.197.232	unknown	Tunisia	37492	ORANGE-TN	false
89.248.34.135	unknown	Switzerland	42346	AS-TINEOInternetServiceProvider-SwitzerlandCH	false
192.221.197.196	unknown	United States	3356	LEVEL3US	false
223.68.161.192	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
54.119.141.84	unknown	United States	16509	AMAZON-02US	false
54.87.50.193	unknown	United States	14618	AMAZON-AESUS	false
132.168.84.171	unknown	France	777	CEA-SaclayEU	false
217.53.86.198	unknown	Egypt	36992	ETISALAT-MISREG	false
172.96.116.38	unknown	United States	21859	ZNETUS	false
217.219.14.73	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
59.60.173.72	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
206.140.22.120	unknown	United States	701	UUNETUS	false
206.41.176.146	unknown	United States	203999	GEEKYWORKSIL	false
121.198.26.176	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
128.80.145.149	unknown	United States	unknown	unknown	false
97.47.196.138	unknown	United States	22394	CELLCOUS	false
18.105.167.248	unknown	United States	3	MIT-GATEWAYSUS	false
183.168.47.167	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
51.58.121.76	unknown	United Kingdom	2686	ATGS-MMD-ASUS	false
61.10.98.209	unknown	Hong Kong	9908	HKCABLE2-HK-APHKCableTVLtdHK	false
5.113.65.140	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	false
52.96.194.56	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
132.209.121.170	unknown	Canada	376	RISQ-ASCA	false
53.60.76.12	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
93.178.28.140	unknown	Saudi Arabia	43766	MTC-KSA-ASSA	false
51.65.109.90	unknown	United Kingdom	2686	ATGS-MMD-ASUS	false
17.202.33.215	unknown	United States	714	APPLE-ENGINEERINGUS	false
129.14.150.39	unknown	United States	786	JANETJiscServicesLimitedGB	false
128.108.78.165	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
187.208.37.241	unknown	Mexico	8151	UninetSAdeCVMX	false
126.230.58.246	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
157.139.31.142	unknown	United States	20252	JSIWMCUS	false
173.35.51.207	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
184.209.111.81	unknown	United States	10507	SPCSUS	false
84.112.43.114	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
196.51.223.10	unknown	South Africa	37518	FIBERGRIDSC	false
14.135.254.241	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
204.160.201.167	unknown	United States	3356	LEVEL3US	false
192.236.176.249	unknown	United States	54290	HOSTWINDSUS	false
89.43.240.163	unknown	Romania	39425	ELECTROSIM-ASRO	false
107.210.162.171	unknown	United States	7018	ATT-INTERNET4US	false
89.103.89.58	unknown	Czech Republic	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
98.228.13.154	unknown	United States	7922	COMCAST-7922US	false
205.50.28.253	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
43.142.72.167	unknown	Japan	4249	LILLY-ASUS	false
223.148.241.47	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
187.10.79.97	unknown	Brazil	27699	TELEFONICABRASILSABR	false
109.67.240.112	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	false
181.26.83.251	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
212.3.103.71	unknown	Ukraine	6702	APEXNCC-ASGagarinaavenuebuilding7room61RU	false
141.74.44.205	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
212.200.249.122	unknown	Serbia	8400	TELEKOM-ASRS	false
193.92.123.52	unknown	Greece	1241	FORTHNET-GRForthnetEU	false
150.136.104.146	unknown	United States	31898	ORACLE-BMC-31898US	false
113.65.120.212	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
13.1.178.163	unknown	United States	7018	ATT-INTERNET4US	false
35.115.119.202	unknown	United States	237	MERIT-AS-14US	false
23.185.116.20	unknown	Reserved	26721	INYOUS	false
92.104.24.31	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
205.54.183.149	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
138.47.255.213	unknown	United States	19564	LATECHUS	false
70.162.191.140	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
204.122.38.215	unknown	United States	1239	SPRINTLINKUS	false
152.60.114.135	unknown	United States	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
137.248.26.129	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
66.148.110.116	unknown	United States	54098	LIONLINK-NETWORKSUS	false
23.164.225.15	unknown	Reserved	393434	AL-DC-US	false
129.206.24.167	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
201.238.25.223	unknown	Venezuela	27889	TelecomunicacionesMOVILNETVE	false
173.87.1.252	unknown	United States	5650	FRONTIER-FRTRUS	false
162.8.123.60	unknown	United States	10457	ILX-ASNUS	false
85.2.39.212	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
2.77.71.11	unknown	Kazakhstan	29355	KCELL-ASKZ	false
74.14.196.35	unknown	Canada	577	BACOMCA	false
52.111.82.236	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.109.0.79	unknown	Germany	29765	DATACHAMBERSUS	false
143.136.135.240	unknown	Japan	2018	TENET-1ZA	false
150.133.42.152	unknown	United States	1649	DNIC-AS-01649US	false
115.18.150.67	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
200.118.227.2	unknown	Colombia	10620	TelmexColombiaSACO	false
202.109.242.38	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
217.237.3.247	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
44.139.46.193	unknown	United States	34387	NETCREWHelsinkiFinlandFI	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
223.169.120.39	eDhBYlsk6K.elf	Get hash	malicious	Mirai	Browse
223.169.120.39	AV9eC3C6ll.elf	Get hash	malicious	Mirai	Browse
178.137.157.93	0xh0roxxnavebusyoo.arm7.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	dFfaflLgJi.elf	Get hash	malicious	Mirai	Browse
	RSDka7Gji5	Get hash	malicious	Mirai	Browse
	k3dBuYbiCS	Get hash	malicious	Mirai	Browse
	0iojYwstAE	Get hash	malicious	Mirai	Browse
172.220.122.192	X6U2at7z1Q.elf	Get hash	malicious	Mirai	Browse
110.35.194.76	OayTT0t7Vi.elf	Get hash	malicious	Mirai	Browse
110.35.194.76	mips-20221013-0611.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-mirai.kro.kr	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLAROSABR	xd.x86.elf	Get hash	malicious	Mirai	Browse	189.16.234.243
	na.elf	Get hash	malicious	Mirai	Browse	201.30.209.153
	pur361ECCi.elf	Get hash	malicious	Mirai	Browse	189.101.230.60
	sora.arm.elf	Get hash	malicious	Mirai	Browse	189.95.122.226
	na.elf	Get hash	malicious	Mirai	Browse	179.105.7.57
	na.elf	Get hash	malicious	Unknown	Browse	187.180.71.227
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	177.35.57.115
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	200.227.227.132
	na.elf	Get hash	malicious	Mirai	Browse	177.56.169.166
	na.elf	Get hash	malicious	Mirai	Browse	200.214.90.137
EUROSATSAAR	xZ2Ha9PYPn.elf	Get hash	malicious	Mirai	Browse	138.99.130.38
	i82HF8QQwf.elf	Get hash	malicious	Mirai	Browse	138.99.129.39
	nY3jvpEUvw.elf	Get hash	malicious	Mirai	Browse	138.99.130.12
	lxmddGFMLf.elf	Get hash	malicious	Mirai	Browse	138.99.129.40
	6zFDtfDv95.elf	Get hash	malicious	Mirai	Browse	170.81.214.95
	x86.elf	Get hash	malicious	Unknown	Browse	170.81.214.96
	5OGAx17mRN.elf	Get hash	malicious	Mirai	Browse	170.81.214.81
	y4hfyLyubW.elf	Get hash	malicious	Mirai	Browse	170.81.214.93
	SecuriteInfo.com.Linux.Siggen.2368.17337.5552.elf	Get hash	malicious	Mirai	Browse	138.99.129.21
	x86.elf	Get hash	malicious	Mirai	Browse	138.99.129.10
CHINABTNChinaBroadcastingTVNetCN	z3hir.arm.elf	Get hash	malicious	Mirai	Browse	223.163.175.171
	6BTZGMvUv1.elf	Get hash	malicious	Unknown	Browse	112.129.202.214
	novo.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	223.169.202.168
	yakov.x86.elf	Get hash	malicious	Mirai	Browse	117.124.85.214
	YEFRJJNJiL.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	42.204.1.100
	arm5.elf	Get hash	malicious	Unknown	Browse	42.204.115.32
	mirai.m68k.elf	Get hash	malicious	Mirai	Browse	112.129.250.164
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	223.170.234.184
	SecuriteInfo.com.Linux.Siggen.9999.6222.10653.elf	Get hash	malicious	Mirai	Browse	117.124.195.201
	firmware.powerpc.elf	Get hash	malicious	Unknown	Browse	223.168.55.178

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5653/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5656/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5658/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5660/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5662/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5664/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5667/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5737/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5767/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5770/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5772/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5774/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5778/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5780/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5783/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5965/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6134/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6145/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6358/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:8dv:8t
MD5:	3B45244025E7367A722E7574BA71DAE5
SHA1:	3413A767919ED5FC05A75E8AA92D3AAAD2F4871F
SHA-256:	6FBAF910C7BD8DC8406DC3BF74DC8C9F28561F3F97781C8AA838AA50B54CE79C
SHA-512:	29D925FD8B8BF895B254A3A5F173D71DEBB3BC3CEBBAD15DE3CC8DA75288BB6D347401820829395C08CDDACEB032DF22AEC480EC7A87AEED12913DE0F7DC52CF
Malicious:	false
Preview:	6148.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:GX:GX
MD5:	8C82397F8D5BD03D668D8CEA842B3D82
SHA1:	6A7509CB3D898FD62AB671BE9826C53587BD22DB
SHA-256:	45E998B88A328D5D5D09C4813629B42ACADDF88B29455F1240343FF5274F2489
SHA-512:	C24F4575429E336F3754FEA6247D7F6A7D78F89FDA38727028CA5DFDD1D4DE6A947455D0A74DA42352E3043AB364A9521B1C63EB21B01B1AD2D44617766FC67B
Malicious:	false
Preview:	5613.

/run/systemd/inhibit/.#1urFFSa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.123896352911406
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifnvJIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfnvJApLHK7wR9n
MD5:	D1EB3E7F8922EDDD54473D77A6AC5D55
SHA1:	5DDBBC6F2A0C876880D1EA46DD1E80713F08E76B
SHA-256:	51F7C9FF9D8CFD4DB52D102DD366A78513A596D233BEF24963559E154B8006CC
SHA-512:	2A597123BDBB94FEB57B6EC8EE5C0E8879AD43A09E3F3A3BC4A6DE6BD4F5BDC486A2D1CFD83C15A8BDB67809060AAB4345AD0772121DC4C349FA6589BF99DC9C
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5973.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#25H78g8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.209300645304899
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+KqgqKLXv0Rsz:qgFqXQXTI1IlfqgqKjcRsz
MD5:	A0DFB05A8A4A4B86603D7C5CAB9728B9
SHA1:	60BDF587E31D829A5934CFD0648C7C65335819EB
SHA-256:	886812CC15F77035D1E93A5A54193FBB1CEF94309C0D0ADB354428B679D77CF7
SHA-512:	570415D5FA89C9388674D862857A5B1A9EAF46BD12490F75A4DBA4CA264A4A628C6DF5E70C424D4E3C207E1BF51467734998763644079485A8506A7413B14EF1
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6178.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3UYGFc9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++pq4iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+KqgqKLXv0RT
MD5:	CF5B7075F0AA2C1BC7C9DDA0791A8D07
SHA1:	94808ED267B0CFB59725776CCE9E1BE9AD920440
SHA-256:	8F31168C6FBC5A25F2251D7238D0EA62447FFCDD9129C2D585DE159C791420B3
SHA-512:	A3D6B757F8C39A58F69A3072C1FD1AEA8B70C55FCC6FFBAD18DE28FDEA0A1FE49558495E72E702123DB7CF1525F0050F193D5F60F62C5ACEFDC9381C160D0ED8
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6178.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4kGmnV7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.165199761184817
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++sWsiXulpv5RX8/SflY:SbFuFyL8OAAx+KylpLRS
MD5:	B1E02E249A228893D1CB776B97F8672A
SHA1:	E9B1C4B91B3EB841040402E456D31D4231C3D166
SHA-256:	F4C630CA1150268107B31C327F0151050CB7A7AADF3FE87631E2902FCDE3E271
SHA-512:	903F4F0B5939D3C012938BE20040D8A4E3E3857B9A3D4E3505BFCFC1BEED070E6CC6AAC9F2953FF9119A33B4E2CD3A78992F78BA73E6E42FC1974E972CBF1EBB
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6193.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/seats/.#seat01wSp9a

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat06Sqlkb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0SEMGl9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0d2AJWb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0hATSTb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0hgheM7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0y1VID9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/sessions/.#c13cyeSa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.496037573267107
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffC5hBxfx2xNIByy6GBK3fJgddmQfc8e:qgFqPuFVuRZI4BKB9x2xayWK3fJgddZ2
MD5:	19CA0468112DF8A9AEA68F946E517477
SHA1:	BAD127F65DBC9449A5437152BF2879D8C2F680BB
SHA-256:	D4292C3CDAD1AABDABEE778ACF6090AD7F0A0758E6B330338FDF737E04C8D258
SHA-512:	A1F31CD7F0E961289E62D8EC5087898629ACE86492EA26ADF5E2AD82283460B81A313F5C002A6A8C6481BBA536E411B8BCBF552A76FE60DC16744415190217D8
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7810.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5637.REALTIME=1728322407699257.MONOTONIC=136558179.

/run/systemd/sessions/.#c19sgHJ8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.441609474702978
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK3fJgddmQfc8e:qgFqPuFN6IG0n99x2xayWK3fJgddZfXe
MD5:	FAC75BAAB76B63FBDA4AE55687E74420
SHA1:	33104A0FECC6F025FB95D12EFEAA8E3BFD6D80CD
SHA-256:	66653E4EDCB654F1F1C903544813CADB517208DBA64F32C366C49E2C2C0FD336
SHA-512:	49184EB242EB710E2FF07A96B4F88ACF2832E3889720967A12E902A3A3ADB2BF8F3F201786FB9542DFA37422030D8A32F10DB359A2F9E1FC351B96A7A1D5AFFD
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5637.REALTIME=1728322407699257.MONOTONIC=136558179.

/run/systemd/sessions/.#c1MTHNo8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.450313584337583
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK3fJgddmQfc8q:qgFqPuFN6IG0n99x2xayWK3fJgddZfXq
MD5:	D4A7A9376BA8DCCF999123583286564F
SHA1:	8451B35DD26CE4824F69C79EC85FD9B3292C6756
SHA-256:	CFA090124E36F77232C9FEAD7F68FB45B92032422A5E15DAD34EBA372E818448
SHA-512:	BBEE44941FE3570F13E46CA6B4804F44867516F7EBEE9911505AE84120AC5C2C15EDA0968EA6ACC55526F49C41CE41E0A1B18C4E958211B89BEF3F26179F51B7
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5637.REALTIME=1728322407699257.MONOTONIC=136558179.CONTROLLER=:1.15.

/run/systemd/sessions/.#c1ZzCrZa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.441609474702978
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK3fJgddmQfc8e:qgFqPuFN6IG0n99x2xayWK3fJgddZfXe
MD5:	FAC75BAAB76B63FBDA4AE55687E74420
SHA1:	33104A0FECC6F025FB95D12EFEAA8E3BFD6D80CD
SHA-256:	66653E4EDCB654F1F1C903544813CADB517208DBA64F32C366C49E2C2C0FD336
SHA-512:	49184EB242EB710E2FF07A96B4F88ACF2832E3889720967A12E902A3A3ADB2BF8F3F201786FB9542DFA37422030D8A32F10DB359A2F9E1FC351B96A7A1D5AFFD
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5637.REALTIME=1728322407699257.MONOTONIC=136558179.

/run/systemd/sessions/.#c1cpGed9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.441609474702978
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBK3fJgddmQfc8e:qgFqPuFN6IG0n99x2xayWK3fJgddZfXe
MD5:	FAC75BAAB76B63FBDA4AE55687E74420
SHA1:	33104A0FECC6F025FB95D12EFEAA8E3BFD6D80CD
SHA-256:	66653E4EDCB654F1F1C903544813CADB517208DBA64F32C366C49E2C2C0FD336
SHA-512:	49184EB242EB710E2FF07A96B4F88ACF2832E3889720967A12E902A3A3ADB2BF8F3F201786FB9542DFA37422030D8A32F10DB359A2F9E1FC351B96A7A1D5AFFD
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5637.REALTIME=1728322407699257.MONOTONIC=136558179.

/run/systemd/sessions/.#c1syyYka

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.400059404391715
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBK3fJgddmQfc8e:qgFqPuFdDJIi9x2xayWK3fJgddZfXe
MD5:	61209C5E000D633E71E042AC634B5539
SHA1:	BDFE6DB184F3C8BCABAF0F6BC4E898C46CFC77A2
SHA-256:	67B51460F165B7293A2B1EE7C68C500C1BB79EB5462709D8FC5E609F84FF0F61
SHA-512:	001FA7F1DADF39F72FC559559D5CFD84CAAAC84A76019B2B77EB8C8D97A6E0D06805CCF5D00E842D78BA7BEE074E737E82F3046E8D2AB85109950D0ABC8F3CFC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5637.REALTIME=1728322407699257.MONOTONIC=136558179.

/run/systemd/sessions/.#c2QwPlba

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.464676684411122
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKMQgxJgdUf9On:qgFqPuFNuCH0nI9x2xayWKMvTgdUf9O
MD5:	A1F4715C12EB0C722DE281D97D5112E1
SHA1:	5565815B285D39A907AE663EADCC34781BAEE539
SHA-256:	849369FB13F91AF358C197F8AC01A43A2CA057BFFE6E2003E2F5751544EA1BAE
SHA-512:	8EC7B1E9B3C9EABD69FB3E621BB080EB9216CBD8804575813BC17A41AA84348FF461112FAA315B44D3BAEB236965CF8FC45E450A07C3571C0111100D281EF758
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5696.REALTIME=1728322420626578.MONOTONIC=149485500.CONTROLLER=:1.19.DEVICES=13:64 13:65 .

/run/systemd/sessions/.#c2Utojn9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.4532452984319635
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKMQgxJgdUf93:qgFqPuFNuCH0nI9x2xayWKMvTgdUf93
MD5:	E3F7DF598FF2793E8266C89A2C7B67B3
SHA1:	AEEAB5824E3409C13290C8A6DC5EDCA88BF39AF6
SHA-256:	F505C4B6B080DEB427FA6E084B3DE74AEB7FD89C07738E36C4E9785CED836A1F
SHA-512:	66750297FDEB40C37C2597631948E07705387F95DB86071B8D49F4FE1E171FA576D77830820C6C615E534119DDFFC068A0F0704154BAB5EA298D6D6971166037
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5696.REALTIME=1728322420626578.MONOTONIC=149485500.CONTROLLER=:1.19.DEVICES=13:64 .

/run/systemd/sessions/.#c2YF9z2b

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.446300381287185
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKMQgxJgdUf91:qgFqPuFNuCH0nI9x2xayWKMvTgdUf91
MD5:	77F29D62C129E1212A67C243A19413AE
SHA1:	CECB0DF097FF6CF572E35AB8F657C6C30D328D14
SHA-256:	ED37F77671541CF0F7DE53C71173D325215F56BDCE2D4DE4F5FCD1C9F63FB875
SHA-512:	E6BFF2953492C062A1018D05D803BB42BEA2C500810CC9F08336C5160495EB0B39BF0437A4ADD3FED8A496C6FC9DFB99AF6A4A692FEA468DC845FEE3F5D05391
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5696.REALTIME=1728322420626578.MONOTONIC=149485500.CONTROLLER=:1.19.

/run/systemd/sessions/.#c2a4Aza9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.434649845263177
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKMQgxJgdUfp:qgFqPuFNuCH0nI9x2xayWKMvTgdUfp
MD5:	F71A313125367D687487041BCFBC0DF9
SHA1:	A83D5ED727E714B78ABC8E3D2915CF6FE69E6973
SHA-256:	F1848BAF0A53C757863101ECA29C37CD7DF8E9231E716395B009E710CE3948D6
SHA-512:	D3F8F4683557BC17DE01916E7CC98AF12424E077828882CD341A4129A202998E8095E972FE17639F7C56565AC06A65BECD6C4DE1D4704C6ADC0807B64821506E
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5696.REALTIME=1728322420626578.MONOTONIC=149485500.

/run/systemd/sessions/.#c2aHsKd9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.473005349336811
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKMQgxJgdUf9Mk:qgFqPuFNuCH0nI9x2xayWKMvTgdUf9Mk
MD5:	4D2857722B4FA9DD6DBF1174F2F78FD3
SHA1:	F8DDFFA4AC84BB2264904C8A5FD6E2B3A920F881
SHA-256:	55B26D6C262E774F930BE31B26856E936C9D13C5B0A2AB1024015FD9E742F229
SHA-512:	E3C59D45D1FFBC64D990328977493D3203300DCF48CADF967EB0C502CB4F311739AD4C27E07EE3DFC971A37F30EAA5E52A1F1211EAD2D65149671F22D611DD5B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5696.REALTIME=1728322420626578.MONOTONIC=149485500.CONTROLLER=:1.19.DEVICES=13:65 13:67 13:64 .

/run/systemd/sessions/.#c2kEBlNb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.474729680678119
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKMQgxJgdUf9Mi:qgFqPuFNuCH0nI9x2xayWKMvTgdUf9Mi
MD5:	08D68515537B84A32E3903AE723E310E
SHA1:	22E527D439B1565BAA40A850A334F84FAC38311D
SHA-256:	AE3324FCDFBFEBCB7400033D875C884928D983C050B4097D0FEFDF26C9EC385A
SHA-512:	12A9E043A676469E8E9E620633E9DC38024117145DC8945758C85F75EC9AE98CAC2FF18352C66EF0B36DA9D48282E1147E4438137F6C7B32F05F9F2ACCBA0011
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5696.REALTIME=1728322420626578.MONOTONIC=149485500.CONTROLLER=:1.19.DEVICES=13:65 13:67 13:66 13:64 .

/run/systemd/sessions/.#c2oYwop9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.434649845263177
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKMQgxJgdUfp:qgFqPuFNuCH0nI9x2xayWKMvTgdUfp
MD5:	F71A313125367D687487041BCFBC0DF9
SHA1:	A83D5ED727E714B78ABC8E3D2915CF6FE69E6973
SHA-256:	F1848BAF0A53C757863101ECA29C37CD7DF8E9231E716395B009E710CE3948D6
SHA-512:	D3F8F4683557BC17DE01916E7CC98AF12424E077828882CD341A4129A202998E8095E972FE17639F7C56565AC06A65BECD6C4DE1D4704C6ADC0807B64821506E
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5696.REALTIME=1728322420626578.MONOTONIC=149485500.

/run/systemd/sessions/.#c2syw8dc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.496895725574204
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffC8gkBxfx2xNIByy6GBKMQgxJgdUfp:qgFqPuFVuRpCvB689x2xayWKMvTgdUfp
MD5:	498684B903E0DB5B00D6C51EAC2D1561
SHA1:	6B1B160467AA5D497262B54E93114171656EDE8F
SHA-256:	6BB3261CAEE53806C64A447423FAA51C4D294B2C1FBE634826D05CE13D602812
SHA-512:	759889E907A75D58A9C9173C9C61A947E3840729543727A0F96AFD1BED83F50F625A26018FA5435344E451B4912357AEA6C9718A3443858200903E201CCEC041
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7873.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5696.REALTIME=1728322420626578.MONOTONIC=149485500.

/run/systemd/users/.#1276aT7R9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.165227832609498
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgdkXncbMnQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegdkXncMjthQHtPnmDqv
MD5:	925346B01BB6A4A376147F0C5B7595C9
SHA1:	9972C92AEBD46ACCBBC027C7F1DCA9E60EAF9D72
SHA-256:	C2037352500C2901CE8A7EE2312E22BCC2BE4A11680C9D9449A9C7A129039F11
SHA-512:	60F265761391CED2DFE21A1CB30D907964EE24FFCDA73FEE9B83BA15868C0B945325B3547977E884F41A194F893185471AC8EBA6458F46009331F7D4DC868D0F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#1277tbt19

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.306992090327339
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBzgdkXncbMnQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBFgdkXncMjthQHtPYb
MD5:	7E620D3F61166717F41894CE6AD51914
SHA1:	62C3A6B55F2EB5F3B0CB0BF4C615FEF7B2C8CF99
SHA-256:	32864C7D6D1852AD6AC232AED449DF3E7F9D952039171E465AEC7CFFFE2EC078
SHA-512:	97CC421F56A3734F6F9EE5CFAE3A769AA907EABCBBEE44D1DC51F04ED627BD950E14C69C4E32A142B94DAE2EE7B9E737EF923AE4ABF5EF886D03AF381B94382A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127C7vCG8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.165227832609498
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgdkXncbMnQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegdkXncMjthQHtPnmDqv
MD5:	925346B01BB6A4A376147F0C5B7595C9
SHA1:	9972C92AEBD46ACCBBC027C7F1DCA9E60EAF9D72
SHA-256:	C2037352500C2901CE8A7EE2312E22BCC2BE4A11680C9D9449A9C7A129039F11
SHA-512:	60F265761391CED2DFE21A1CB30D907964EE24FFCDA73FEE9B83BA15868C0B945325B3547977E884F41A194F893185471AC8EBA6458F46009331F7D4DC868D0F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127DNXx0a

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.1793503354073875
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgdkXncbMnQ2thQc2x9sS02nmD2owC:qgFq30dAL/ixegdkXncMjthQHxbPnmDd
MD5:	2804E4F5299E3F61A94476E8DAFFADCB
SHA1:	F6BD7EB5BFB88E6FBEF79ACB27CBAD0DE2A238C7
SHA-256:	DCD1003E06CBB96D23967B0F6EB3D6CD4C4CEF181342449D9FD9302F98E8016D
SHA-512:	7420ACA635EBC302E63FC60923E295C79AF69AFA6AD4A738F00418A5DAFCEBD699D8E6B654AB3C1809BFDC8E17DD90358EF1E669A967D5B10D52FB8985B0945C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127SN1ny9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127VUuj68

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.174305976764448
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgdkXncbMnQ2z5c2zw02zb2owB:qgFq30z1cL/ixxTgdkXncMjz5HzwPzbA
MD5:	D3D75DB47CFBF6E30DB21A1F4FFD3797
SHA1:	128079D510E122D84654367AA8C8B88F9C012587
SHA-256:	9D1E83129DB5AF5E17A508B43ECABC349046B62AFD526328E84FB9D207D763B6
SHA-512:	CE5974929431467E49DA984C1F85CF93B5B8B0031794488C363BE44AA5EC09EF536ADAA1F861E01F1CC3675D08485C0E60A0BA251BF63FF020660799E899918B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Vxuvab

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.158369721784368
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgdkXncbMnQ2z5c2zw02zb2owB:qgFq30NzL/ixxTgdkXncMjz5HzwPzbA
MD5:	F0456860606D08047BFDD9D6FF8E1E56
SHA1:	7760008DED2DE4936780C00F70123D9AE26563FC
SHA-256:	79250C48DBC16FC5DD1DB85256EF149312091B68D0E8AFB08BB79C8032FAFF5E
SHA-512:	3A40DBDB89C75B9BF4D317E7CC6E843241C84D8BE0C8FEB50D1B5AF13A9A4C2FE2C1F487B3E180FDA0200DD74BAA167805B80EDDFE2ECC251A7D7014A4D3BC23
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127dGGOma

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.177970058591317
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgdkXncbMnQ2thQc2x9sS02/g2owB:qgFq30z1cL/ixegdkXncMjthQHxbPYA
MD5:	A68D59E543445B627F23836C9C4173D2
SHA1:	EB3DBC343B69A1C9E90CF92A61E3BAE006F43FDE
SHA-256:	C8380C5ECEC66D0699BCDC34BA8A348547277064310401296D1C138FA0CF97D8
SHA-512:	834DDDAEA240D29C5C9453D325D8E0954D22883EAD69F7C9E9416E7EA1C01F80273FD4A4BB35D049FDC4FE00B3F833F86EAE274D7CE6A68378B7C1D0CF358B99
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127k3VwKa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.331048125398985
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBvYfgdkXncbMnQ2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBFIgdkXncMjthQHxbt
MD5:	0851D50149D044531316E805C1A5B9C6
SHA1:	2F6601CE3D049B4E208DDE7791DAAB930F2CCBBF
SHA-256:	EF5AAFF8F21FA3BE4FBCBC822EF3D4DAD2EF2CD4836823CC188356D463FD7262
SHA-512:	DF1147B2415088D742815D071246BB2D915687F44CDA864C9F42B7F2595DEA7DDD5D22102E15D318BF7CFD0AA12B2F242C6C2865086CE700EFEEB2B37578A49C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.DISPLAY=c1.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127p1vNua

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.162033803611236
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgdkXncbMnQ2thQc2x9sS02/g2owB:qgFq30NzL/ixegdkXncMjthQHxbPYA
MD5:	8DA688DADC8062CBA48796E8756ED311
SHA1:	D84E28CD43CF332E391A3B4B5F976FC38E8EC28B
SHA-256:	6DF9615C99B1ACBEB0816D274C0B022D2E228736D59E71C95ABBBE14357AFCE1
SHA-512:	829D9B294BB6EA7D9B917C23B7D65756379D1503657FC6DCE0178801FA88AF03AD1D98FD159738A984CED1158D1D23AA5E52C1DDEA0BBDDA36E3E5C82F21536E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127qxKmZ8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.153750827835329
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgdkXncbMnQ2z5c2zw02zb2owB:qgFq30z1cL/iRJgdkXncMjz5HzwPzbA
MD5:	8C77E7D094EFFFEED5874EAA2C83D7F1
SHA1:	EB9922EA80D810275DDB014E363BAA660689B86B
SHA-256:	D1BA1C86C5DB1518C3108F13961C875A578F56C059417EEDE5B8015CB4D20DFF
SHA-512:	E696FD7BEC592C33E85CB1F9B424187C1443D73FD51052E49896D643EC5E89F03C8EFED5901E1F9DB9CE224C05252B2B665BDB34B3E700A304B8F49829E403C9
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ys6FY8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.311464203143709
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffBzgdkXncbMnQ2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBFgdkXncMjthQHxbPF
MD5:	C69B05E6B95A5D8A5878A21E58F11B63
SHA1:	6F92F73BEC0CD8407E2A2DCCDF497F5151BDCEC5
SHA-256:	67C423717D6C8616C279EB32FB2DAF42F09A118F0563CF1DEFA37B063C9E4124
SHA-512:	69DE1C8558259D225BE8482503B31B43B91B1554A9F2027C5AFA0AFD52CB1D7342370736CCD5760B54F6D6E0D30299692FD5B6073DBF985FA17CC41A75150532
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7748.REALTIME=1728322407680351.MONOTONIC=136539273.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:EQvn:E6n
MD5:	F56F9FB00B71CB067986784D5E991143
SHA1:	13BB4B7322A6579154139C419A69E258EE035037
SHA-256:	A2BE847352294E6C70FFCB8412C000021AF4DBA13806B2BCAB6F114754CFC689
SHA-512:	F5470701F6230A79693ECED672C4A77D7708068E91611BC0867297B6E58BCEDA24F0AA63FE3EA9149CA3682587EF2E8EC5B97BB68E43B65534C33A0B94015B07
Malicious:	false
Preview:	5487.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.026855871304038
Encrypted:	false
SSDEEP:	12:OxP1w1OveY+1pt4xPykveY+yZOxPH+rl9NOveY+H+5AxPu3o3ulveY+u3o3pHovZ:1hwWyetbFZybu4AXx1
MD5:	A901DFBBFC619AC7074B05722CB0058F
SHA1:	D45D23F402C417895DBF9806D1B794CAD6B44424
SHA-256:	38F3D21C7F24692D1483A8F534533EFD5BDB853C11568FA1943D1DE1FE4E5B58
SHA-512:	1CA58BC32548C1245759A8691FB38AB1AD342BC7912669FE2266C62F44A03EC5CC5E231A4FEE79B4258A7E30BE45B39BE19005162641A687C2A7FC20BA998603
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5723..MIT-MAGIC-COOKIE-1....sU,*...:.0.....XSMP...#local/galassia:@/tmp/.ICE-unix/5723..MIT-MAGIC-COOKIE-1...D.".....s.%.....ICE...!unix/galassia:/tmp/.ICE-unix/5647..MIT-MAGIC-COOKIE-1..[.J..>.h...`.c....ICE...#local/galassia:@/tmp/.ICE-unix/5647..MIT-MAGIC-COOKIE-1..D....^...P.B..1..XSMP...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....3.16G.\|.Q.......XSMP...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..uoT..;.......%....ICE...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...)....I...b....L..ICE...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1..j...w~q]$M....<...XSMP...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...i...........LE..XSMP...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...e.....-..3$....ICE...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....<..;..6<L.......ICE...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..ad.U~.OxR.c.}..(..XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.02175632566041
Encrypted:	false
SSDEEP:	3:rg/WFllasO934+qQwM8ENWFllasO934+qQwM/:rg/WFl2I+lzNWFl2I+lh
MD5:	F75CCC59230302460BBCD255773E52E7
SHA1:	96EF7627855E799A46307009F52269862B031F03
SHA-256:	0A65B443FA89AD5787F8ACA19072C59DF2B4386661C9382140A4A52F69BA3412
SHA-512:	1041040A9AB22DA07043903719D9EEA4A7F5717DB2B128A78B5D432822DAF72E31ED8B2A6B3E34396036B8DF093AB0226145F6F68970A176457A193310099B88
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1.....c];N=v...S.).....galassia....MIT-MAGIC-COOKIE-1.....c];N=v...S.).

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:ovn:ov
MD5:	B91EA4DFDBA88FAF7F257396153FFE66
SHA1:	94D498A4DD68BCE00407069ABB61B09D34F4FBAE
SHA-256:	3C208E45BFEFAC02B40CF48761225B9F22328CE339CAB8990A4E99765A0D50BF
SHA-512:	A2937069B8A378E4F10BD00BAB4E22884F04B1329FD77D1AD3FB70D0B94D642B669F1883BA89EDC979E62EA925EEE504A48CFC5ECF138FE9E036CFFAFDBCF246
Malicious:	false
Preview:	6016.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:i0sXlXEWtl/weCCN4:iV+yl4dCN
MD5:	21E7AEFF2D090712BCCEAEA9F65CDEB9
SHA1:	00BB4C9D2F8F6081CEDF08040BF882D6B0DC702D
SHA-256:	6051D9A30EFEEB870FDBA9DEB882724312082AB633B5D504312A0F4F4FAA5B2C
SHA-512:	0BBD67D4B04BE9C02BE3589FAC4026F6B58D2EA300181C8DD5B1F02895A629E40324665A7A83AFF22077EA8C3F18521F9CA643E962C70EA34F42B3AA7FBE5384
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................R..g'h......................................

/tmp/qemu-open.PmWGSZ (deleted)

Download File

Process:	/tmp/XvAqhy3FO6.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgUGn:TgUGn
MD5:	034AA3AAB34563F4206E9887E213F77C
SHA1:	BA9A062D956BAC51262DFBCFD517C526A3E6FDB1
SHA-256:	AD9485B52BDBF27784FEBE449B6FE1D92122DF2E5EEB467E0E4735B34F9163C3
SHA-512:	0CB5E1B332A9CBD95747A52F1E1C85D1A4DBAE42A90940DCD7F3D32F443B8DB5E01D6084AA4EAFC50DF8E47EC43B2A856B6910A740A4BB8AC9DBB8F1D242D605
Malicious:	false
Preview:	/tmp/XvAqhy3FO6.elf.

/tmp/qemu-open.XqbNLy (deleted)

Download File

Process:	/tmp/XvAqhy3FO6.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgUGn:TgUGn
MD5:	034AA3AAB34563F4206E9887E213F77C
SHA1:	BA9A062D956BAC51262DFBCFD517C526A3E6FDB1
SHA-256:	AD9485B52BDBF27784FEBE449B6FE1D92122DF2E5EEB467E0E4735B34F9163C3
SHA-512:	0CB5E1B332A9CBD95747A52F1E1C85D1A4DBAE42A90940DCD7F3D32F443B8DB5E01D6084AA4EAFC50DF8E47EC43B2A856B6910A740A4BB8AC9DBB8F1D242D605
Malicious:	false
Preview:	/tmp/XvAqhy3FO6.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.D1SJV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.RBEDV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.1126344891036455
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWW0rGT7/A19R:q5sU3LWfLUDmQymqSFbfomSyST74fZv
MD5:	84E9C1FBE4D564219E3FCF1269EFF033
SHA1:	39AAC3A24258D485BACC6DB7F74F7A20CE3EE8F4
SHA-256:	6FFA7FF3F93357649F427EAF6C6409DFBBE4C6A6EC9E6DF76DC6202C6C0C113F
SHA-512:	F6099DB714CB5EBFBD0675E1A776B129F10DD1EE1F9567FE8337CA2ECB923CB96A4C10C97152529AE63756C18659182E8310545A73F08DE5372123A6133CBC57
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-4pbwo8pB,guid=2cd421bbf7b3fa476cb67e6f67041ba3.IBUS_DAEMON_PID=5917.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.286877124185077
Encrypted:	false
SSDEEP:	384:P/wkZ7rIn9BMxgdLdidbdRdUdIdNdHdxdFdQdBdFdGdPdKdpdvdZdfdBmd8JdEq7:P/fZ7U0xUbHOVEiKElfAhEeJn
MD5:	7F4277E107839938FF2544A7BC62DE21
SHA1:	F3676720C3D51DCD42092C7BA67E2F99DE46F05A
SHA-256:	EB574F74C4136BAFD23BDD5DC9832F0A9F3C9ABC9D135479269E0C151DA0921F
SHA-512:	F0085F7E700D5CD2EC6E1F6470BBD405C73BA87815B56CEB5B7F2482598775ABC939FC119DE8CACDA7E9847C1AAEBF5D13AAEE6BB96F879BD8613122B64810F4
Malicious:	false
Preview:	[ 150.521] (--) Log file renamed from "/var/log/Xorg.pid-5705.log" to "/var/log/Xorg.0.log".[ 150.542] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 150.553] Build Operating System: linux Ubuntu.[ 150.560] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 150.568] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 150.589] Build Date: 06 July 2021 10:17:51AM.[ 150.596] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 150.629] Current version of pixman: 0.38.4.[ 150.657] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 150.664] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	Unknown
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.962106432188526
Encrypted:	false
SSDEEP:	24:u2Z402Ze1GBBGN7GNCxNTAv6TA2+VIFC7iKq8eVeqRl2rCQHzbNFd4MnMsXdcXjw:mvbfVfQr8TrCmBmO2rbo6rCn
MD5:	1B3FEB3D9B279BFB77A675CAC3BFB336
SHA1:	1328D2951F6D213A7508521219041E21DE6A4B60
SHA-256:	C25029010C8275507B17C1A511C2D94189521D57F3598A6CBC9CC1B7DE5841DB
SHA-512:	7EACEAB02F65F362CB4E0D87BF06C7BB882712C84D9B005FB6B40D8E95104C26C50BA033829FD5639BE5F106867C91F7148E25B28E37335CD0556F98DE3C1A2E
Malicious:	false
Preview:	Oct 7 12:33:05 galassia systemd-logind[5501]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 7 12:33:05 galassia systemd-logind[5501]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 7 12:33:05 galassia systemd-logind[5501]: User enumeration failed: Invalid argument.Oct 7 12:33:05 galassia systemd-logind[5501]: User of session c2 not known..Oct 7 12:33:05 galassia systemd-logind[5501]: User of session 2 not known..Oct 7 12:33:05 galassia systemd-logind[5501]: Session enumeration failed: No such file or directory.Oct 7 12:33:05 galassia systemd-logind[5501]: Watching system buttons on /dev/input/event0 (Power Button).Oct 7 12:33:05 galassia systemd-logind[5501]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Oct 7 12:33:05 galassia systemd-logind[5501]: New seat seat0..Oct 7 12:33:05 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to release session: No session 'c2' kno

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	Unknown
Category:	dropped
Size (bytes):	42408
Entropy (8bit):	4.719820186772608
Encrypted:	false
SSDEEP:	384:DjNG0oTYu47Doiu+GP1ufqzpjLdledfZVI3K2XOtU:M0oTYu47Doiu+FPQKhU
MD5:	B6A2AF08BE44E761CB8924DE06EFF6E8
SHA1:	A6C84809E8D5C53BD6DD220B694802E7E293D7F9
SHA-256:	82A1BA691361B72A40E2562661AD7DC0745DBD5E8FA83194FEB5C462C41F7C69
SHA-512:	BBE0D95A5C2F627F8475D6F760ED4FB3B214B825D711398A323C50B21DC1E0CD0EAE4078E6F8CF50CE44116E90511F756EE76802A4498101769B5B185E7A20E6
Malicious:	false
Preview:	Oct 7 12:33:02 galassia kernel: [ 110.479329] MD5 calculation failed.Oct 7 12:33:02 galassia kernel: [ 110.563999] blocking signal 9: 5427 -> 936.Oct 7 12:33:02 galassia kernel: [ 110.602335] blocking signal 9: 5427 -> 1400.Oct 7 12:33:02 galassia kernel: [ 110.776461] blocking signal 9: 5427 -> 1805.Oct 7 12:33:02 galassia kernel: [ 110.960207] blocking signal 9: 5427 -> 3069.Oct 7 12:33:02 galassia kernel: [ 111.074674] blocking signal 9: 5427 -> 3132.Oct 7 12:33:02 galassia kernel: [ 111.830904] New task spawned: old: (tgid 5486, tid 5486), new (tgid: 5486, tid: 5493).Oct 7 12:33:02 galassia kernel: [ 111.832634] New task spawned: old: (tgid 5486, tid 5486), new (tgid: 5486, tid: 5494).Oct 7 12:33:02 galassia kernel: [ 111.837795] New task spawned: old: (tgid 5486, tid 5493), new (tgid: 5486, tid: 5495).Oct 7 12:33:02 galassia kernel: [ 111.960758] blocking signal 9: 5433 -> 660.Oct 7 12:33:03 galassia kernel: [ 112.189626] blocking signal 9: 5433 -> 726.Oct 7

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	Unknown
Category:	dropped
Size (bytes):	152634
Entropy (8bit):	5.206339918334533
Encrypted:	false
SSDEEP:	768:tSU+TV0/Z8u47DoiuFOR0JQfmmyyyEFB6CVyHosjoST:BE0QJvyEFBHMoST
MD5:	CFBF78C237618476454F621C5A6797D2
SHA1:	CBF13D184762F51AAB13E2AC0EA647974AB0837C
SHA-256:	63B03D1768AC94882F9792CC5ADD88A2090A11DB5BC6264854E845C1C594DD89
SHA-512:	B6551F79599766720A6FDB3C6A273E25EA2953D134236924F14FC6536C07B189D2CFBAACFC43B41654A399177AEF2F7109314112A00C27EC45D9E9B7294A310B
Malicious:	false
Preview:	Oct 7 12:33:01 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 7 12:33:02 galassia kernel: [ 110.479329] MD5 calculation failed.Oct 7 12:33:02 galassia kernel: [ 110.563999] blocking signal 9: 5427 -> 936.Oct 7 12:33:02 galassia kernel: [ 110.602335] blocking signal 9: 5427 -> 1400.Oct 7 12:33:02 galassia kernel: [ 110.776461] blocking signal 9: 5427 -> 1805.Oct 7 12:33:02 galassia kernel: [ 110.960207] blocking signal 9: 5427 -> 3069.Oct 7 12:33:02 galassia kernel: [ 111.074674] blocking signal 9: 5427 -> 3132.Oct 7 12:33:02 galassia kernel: [ 111.830904] New task spawned: old: (tgid 5486, tid 5486), new (tgid: 5486, tid: 5493).Oct 7 12:33:02 galassia kernel: [ 111.832634] New task spawned: old: (tgid 5486, tid 5486), new (tgid: 5486, tid: 5494).Oct 7 12:33:01 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 7 12:33:01 galassia systemd[1410]: dbus.service: Main process exited, code=killed, status=9/KILL

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:i0sXlXEWtl/weCCN4:iV+yl4dCN
MD5:	21E7AEFF2D090712BCCEAEA9F65CDEB9
SHA1:	00BB4C9D2F8F6081CEDF08040BF882D6B0DC702D
SHA-256:	6051D9A30EFEEB870FDBA9DEB882724312082AB633B5D504312A0F4F4FAA5B2C
SHA-512:	0BBD67D4B04BE9C02BE3589FAC4026F6B58D2EA300181C8DD5B1F02895A629E40324665A7A83AFF22077EA8C3F18521F9CA643E962C70EA34F42B3AA7FBE5384
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................R..g'h......................................

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.53467762878995
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	XvAqhy3FO6.elf
File size:	85'744 bytes
MD5:	1b895813a33cd6d036e4b82faed190c2
SHA1:	674f2afd17eeaa10f642b4b2a5c47d9d7d2795a5
SHA256:	67965ef52efc331b6ad7a44e99a793c4def5302dd7d63287bae32ebcc568f41a
SHA512:	4d524fc0568d5facbf6a0e277eb56ddfe68970ca08631e4361af2a6c8ee2b2a9e447aaa36184568ae8c4677d1af2e3252ccbbac547cc4b13681739502aad6e5e
SSDEEP:	1536:5K0SSlwesgAxWtF9Nk/s3UVUP6t0MUtwWWEUFF:5K0pag9B3Ue6etRWN
TLSH:	3B83E806BF651FFBDC9FCD374AA9170128CC651A22A53B357A74D818B64B24F0AE3C64
File Content Preview:	.ELF....................`.@.4....L......4. ...(...............@...@..C...C...............C...CE..CE.....\|+..........Q.td...............................<l..'!......'.......................<H..'!... .........9'.. ........................<...'!............+9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	85184
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x12b00	0x0	0x6	AX	16
.fini	PROGBITS	0x412c20	0x12c20	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x412c80	0x12c80	0x1730	0x0	0x2	A	16
.ctors	PROGBITS	0x4543b4	0x143b4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x4543bc	0x143bc	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x4543c8	0x143c8	0xc	0x0	0x3	WA	4
.data	PROGBITS	0x4543e0	0x143e0	0x430	0x0	0x3	WA	16
.got	PROGBITS	0x454810	0x14810	0x44c	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x454c5c	0x14c5c	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x454c80	0x14c5c	0x22b0	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x9a2	0x14c5c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x14c5c	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x143b0	0x143b0	5.5587	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x143b4	0x4543b4	0x4543b4	0x8a8	0x2b7c	3.7882	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 19:32:59.743283987 CEST	192.168.2.13	8.8.8.8	0x6ccc	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:01.508079052 CEST	192.168.2.13	8.8.8.8	0xcbe3	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 19:33:00.740848064 CEST	8.8.8.8	192.168.2.13	0x6ccc	No error (0)	byte-mirai.kro.kr		154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 7, 2024 19:33:01.515419960 CEST	8.8.8.8	192.168.2.13	0xcbe3	No error (0)	byte-mirai.kro.kr		154.216.20.119	A (IP address)	IN (0x0001)	false

Start time (UTC):	17:32:49
Start date (UTC):	07/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	17:32:58
Start date (UTC):	07/10/2024
Path:	/tmp/XvAqhy3FO6.elf
Arguments:	/tmp/XvAqhy3FO6.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	17:32:59
Start date (UTC):	07/10/2024
Path:	/tmp/XvAqhy3FO6.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	17:33:01
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:04
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:05
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:06
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:33:07
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:08
Start date (UTC):	07/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:33:09
Start date (UTC):	07/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:33:10
Start date (UTC):	07/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:33:11
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:12
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:33:23
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report XvAqhy3FO6.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5653/oom_score_adj

/proc/5656/oom_score_adj

/proc/5658/oom_score_adj

/proc/5660/oom_score_adj

/proc/5662/oom_score_adj

/proc/5664/oom_score_adj

/proc/5667/oom_score_adj

/proc/5737/oom_score_adj

/proc/5767/oom_score_adj

/proc/5770/oom_score_adj

/proc/5772/oom_score_adj

/proc/5774/oom_score_adj

/proc/5778/oom_score_adj

/proc/5780/oom_score_adj

/proc/5783/oom_score_adj

/proc/5965/oom_score_adj

/proc/6134/oom_score_adj

/proc/6145/oom_score_adj

/proc/6358/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1urFFSa

/run/systemd/inhibit/.#25H78g8

/run/systemd/inhibit/.#3UYGFc9

/run/systemd/inhibit/.#4kGmnV7

Linux Analysis Report
XvAqhy3FO6.elf

Start time (UTC):	17:33:25
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:33:28
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	17:33:29
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --nofork --print-address 4 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:33:30
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:33:31
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:33:32
Start date (UTC):	07/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:33:33
Start date (UTC):	07/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	17:33:34
Start date (UTC):	07/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	17:33:38
Start date (UTC):	07/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:33:41
Start date (UTC):	07/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a