Linux Analysis Report
Aqua.arm5.elf

Overview

General Information

Sample name: Aqua.arm5.elf
Analysis ID: 1580706
MD5: 02ef5e852076cf9c563fbaa180646c85
SHA1: ec96ee7b457856f00fe02fe4c5579617f4adc054
SHA256: 3d7d516288e90fb68be50e151604f949215d982538d3d53cbfce723fe24a35f4
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Reads system files that contain records of logged in users
Sample deletes itself
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Deletes log files
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Found strings indicative of a multi-platform dropper
Reads CPU information from /sys indicative of miner or evasive malware
Reads system version information
Reads the 'hosts' file potentially containing internal network hosts
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Aqua.arm5.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: Aqua.arm5.elf ReversingLabs: Detection: 42%
Source: Aqua.arm5.elf Virustotal: Detection: 38% Perma Link
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pkill (PID: 5818) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6080) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6343) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6779) Reads CPU info from /sys: /sys/devices/system/cpu/online
Found strings indicative of a multi-platform dropper
Source: Aqua.arm5.elf String: EOF/proc//proc/%s/cmdlinerwgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:37424 -> 89.190.156.145:7733
Reads the 'hosts' file potentially containing internal network hosts
Source: /usr/sbin/rsyslogd (PID: 5791) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5815) Reads hosts file: /etc/hosts Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5905) Reads hosts file: /etc/hosts Jump to behavior
Sample listens on a socket
Source: /usr/sbin/gdm3 (PID: 5978) Socket: unknown address family Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6006) Socket: unknown address family Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6007) Socket: unknown address family Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042) Socket: unknown address family Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) Socket: unknown address family Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) Socket: unknown address family Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6060) Socket: unknown address family Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 6260) Socket: unknown address family
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: global traffic DNS traffic detected: DNS query: 45.148.10.84
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: syslog.67.dr, Xorg.0.log.146.dr String found in binary or memory: http://wiki.x.org
Source: syslog.67.dr, Xorg.0.log.146.dr String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.67.dr, syslog.35.dr, syslog.55.dr String found in binary or memory: https://www.rsyslog.com

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 1679, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5554, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 723, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 724, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 779, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 782, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 789, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 796, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 1440, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 3060, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 3220, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5532, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5533, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5717, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5730, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5791, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5805, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5808, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 3047, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5811, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5815, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5816, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) SIGKILL sent: pid: 6073, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) SIGKILL sent: pid: 6295, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) SIGKILL sent: pid: 6471, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) SIGKILL sent: pid: 6454, result: successful Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 1679, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5554, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 723, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 724, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 779, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 782, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 789, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 796, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 1440, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 3060, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 3157, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 3220, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5532, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5533, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5717, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5730, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5791, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5805, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5808, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 3047, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5811, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5815, result: successful Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552) SIGKILL sent: pid: 5816, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) SIGKILL sent: pid: 6073, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) SIGKILL sent: pid: 6295, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) SIGKILL sent: pid: 6471, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) SIGKILL sent: pid: 6454, result: successful Jump to behavior
Source: classification engine Classification label: mal72.spre.troj.evad.linELF@0/107@122/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 5717) File: /proc/5717/mounts Jump to behavior
Source: /bin/fusermount (PID: 5798) File: /proc/5798/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5811) File: /proc/5811/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5914) File: /proc/5914/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6006) File: /proc/6006/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File: /proc/6059/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File: /proc/6079/mounts Jump to behavior
Source: /usr/bin/gjs (PID: 6472) File: /proc/6472/mounts Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118) File: /proc/6118/mounts
Source: /usr/bin/dbus-daemon (PID: 6003) File: /proc/6003/mounts
Source: /usr/bin/dbus-daemon (PID: 6778) File: /proc/6778/mounts
Creates hidden files and/or directories
Source: /usr/libexec/gsd-rfkill (PID: 5554) Directory: <invalid fd (9)>/.. Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5554) Directory: <invalid fd (8)>/.. Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5559) Directory: <invalid fd (10)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5731) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5731) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5731) File: /run/systemd/seats/.#seat00bKj5v Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5794) Directory: /root/.cache Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5824) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5824) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5824) File: /run/systemd/seats/.#seat0aWx1rC Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (18)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (17)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/seats/.#seat0vNzIAG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127d0hA7G Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127dZcUBF Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c15YluFH Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127PZOo6G Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/seats/.#seat0mzw6OI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#1271IdlrI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c1SQVpXI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c1eG8dzI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127AfItbG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (21)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (20)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/seats/.#seat06bxeTI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c145ZkLI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127nBMILF Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c1q6pdXI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c1swftzI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c1lEZWSG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127wom63G Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (20)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (19)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/seats/.#seat0bDf9lF Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127Kta8GI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/seats/.#seat0XmrqJE Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127jfCEOI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/seats/.#seat0QNkJIH Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#1275Em6EF Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c2wz7PrG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#1277LDHAI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/seats/.#seat0XzcaBI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c20BO4sF Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c2qGsSDG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/users/.#127MuOcoI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c2GMeBkG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c2dzB76F Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (21)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c2oMAgNI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c2VBsTPG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (24)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/sessions/.#c2bPQHbG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/inhibit/.#1aytZsF Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/inhibit/.#2t9Sc1I Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/inhibit/.#3i3aUvI Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/inhibit/.#4EuBOhG Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918) File: /run/systemd/inhibit/.#5gzYi4G Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6029) Directory: <invalid fd (11)>/.. Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6029) Directory: <invalid fd (10)>/.. Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042) Directory: <invalid fd (23)>/.. Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042) Directory: <invalid fd (22)>/.. Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061) Directory: /var/lib/gdm3/.drirc Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061) Directory: /var/lib/gdm3/.Xdefaults Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061) Directory: /var/lib/gdm3/.Xdefaults-galassia Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6080) Directory: /var/lib/gdm3/.drirc Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090) Directory: /var/lib/gdm3/.Xdefaults Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090) Directory: /var/lib/gdm3/.Xdefaults-galassia Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090) Directory: /var/lib/gdm3/.drirc Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118) Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6118) Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 6118) Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6118) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 6118) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 6118) Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 6118) Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6292) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6292) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6488) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6488) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6491) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6491) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6492) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6492) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6494) Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6494) Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499) Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6513) Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6513) Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982) Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982) Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 5991) Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6303) Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6303) Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6469) Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6529) Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6716) Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6743) Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6743) Directory: <invalid fd (11)>/..
Enumerates processes within the "proc" file system
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6079/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6079/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6455/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6488/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6499/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6090/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6061/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6292/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6492/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6491/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6513/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079) File opened: /proc/6118/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6296/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6472/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6494/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6493/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6495/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6498/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6499/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6510/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6455/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6059/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6059/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6074/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6492/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6491/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6524/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6502/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6505/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6508/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6486/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6488/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6061/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6060/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6060/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6260/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6513/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059) File opened: /proc/6118/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717) File opened: /proc/5790/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717) File opened: /proc/5794/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717) File opened: /proc/5730/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717) File opened: /proc/5717/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717) File opened: /proc/5717/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717) File opened: /proc/1/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717) File opened: /proc/5731/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5385/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5385/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/110/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/110/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/231/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/231/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5816/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5816/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/111/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/111/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5817/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5817/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/112/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/112/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/233/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/233/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5818/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5818/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/113/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/113/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/114/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/114/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/235/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/235/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/115/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/115/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/116/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/116/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/117/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/117/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/118/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/118/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/119/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/119/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/911/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/911/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5811/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5811/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/914/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/914/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5812/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5812/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/10/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/10/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5815/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/5815/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/11/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/11/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/12/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/12/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/13/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/13/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/14/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/14/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/15/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/15/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/16/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/16/cmdline Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/17/status Jump to behavior
Source: /usr/bin/pkill (PID: 5818) File opened: /proc/17/cmdline Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/bin/gpu-manager (PID: 5809) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5813) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6051) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\"" Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6293) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\"" Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5988) Shell command executed: sh -c "locale -a | grep -F .utf8 "
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5810) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 5814) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 5990) Grep executable: /usr/bin/grep -> grep -F .utf8
Executes the "kill" or "pkill" command typically used to terminate processes
Source: /usr/share/gdm/generate-config (PID: 5818) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Reads system version information
Source: /sbin/agetty (PID: 5805) Reads version info: /etc/issue Jump to behavior
Source: /sbin/agetty (PID: 5816) Reads version info: /etc/issue Jump to behavior
Source: /sbin/agetty (PID: 5906) Reads version info: /etc/issue Jump to behavior
Sample tries to set the executable flag
Source: /usr/sbin/gdm3 (PID: 5978) File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5978) File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/rsyslogd (PID: 5791) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5791) Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5815) Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5815) Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5905) Log file created: /var/log/kern.log Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5905) Log file created: /var/log/auth.log Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 6042) Log file created: /var/log/Xorg.0.log Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/Aqua.arm5.elf (PID: 5550) File: /tmp/Aqua.arm5.elf Jump to behavior
Deletes log files
Source: /usr/bin/gpu-manager (PID: 5808) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042) Truncated file: /var/log/Xorg.pid-6042.log Jump to behavior
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pkill (PID: 5818) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6080) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6343) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6779) Reads CPU info from /sys: /sys/devices/system/cpu/online
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/Aqua.arm5.elf (PID: 5548) Queries kernel information via 'uname': Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5559) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5791) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5805) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5815) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5816) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5905) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 5906) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5995) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6007) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6035) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 6040) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 6074) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 6455) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6060) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6080) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118) Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6292) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6488) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6491) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6492) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6495) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6499) Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6513) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6343) Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6465) Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6469) Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6529) Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6793) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6779) Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6816) Queries kernel information via 'uname':
Source: Xorg.0.log.146.dr Binary or memory string: [ 203.674] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.175] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.695] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.885] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.673] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.130] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.976] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.326] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.891] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.458] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.047] (WW) vmware(0): Disabling 3D support.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.141] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.156] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.845] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.534] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.391] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.608] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.442] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.506] (--) vmware(0): vis: 4
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.199] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.526] (==) vmware(0): Default visual is TrueColor
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.965] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.240] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.752] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.449] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.799] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.167] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.066] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.481] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.085] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.056] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.601] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.398] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.312] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.190] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.365] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.458] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.923] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.208] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.456] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.123] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.529] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.921] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.811] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.468] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.713] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.721] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.257] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.227] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.119] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.163] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:16 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.720] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.173] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.186] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 203.452] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.999] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.972] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.601] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 211.991] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.196] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.686] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.607] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.55.dr Binary or memory string: Dec 25 10:44:45 galassia kernel: [ 172.417661] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp parport drm ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper mptspi scsi_transport_spi psmouse mptscsih mptbase ahci libahci vmxnet3
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.507] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.799] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.953] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.550] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.546] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.171] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.989] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.874] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.137] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.112] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.054] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.702] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.462] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.654] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.759] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.637] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.008] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Default visual is TrueColor
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.217] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.290] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.765] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.566] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): depth: 24
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): vis: 4
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.917] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 203.379] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.649] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.591] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.193] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.693] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.319] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.664] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.026] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.131] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.520] (==) vmware(0): RGB weight 888
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.224] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.916] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.643] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.513] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.556] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.992] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.201] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.358] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.059] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.061] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.947] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.626] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.621] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.912] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.452] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.154] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.371] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.938] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.264] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.005] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.238] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.019] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.660] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.55.dr Binary or memory string: Dec 25 10:44:45 galassia kernel: [ 172.417679] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.509] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.335] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.537] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.538] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.575] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.899] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.689] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.252] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.826] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.526] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.887] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.779] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.852] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.573] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.500] (--) vmware(0): w.blu: 8
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.616] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.898] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.893] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.482] (--) vmware(0): bpp: 32
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:15 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) LoadModule: "vmware"
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (WW) vmware(0): Disabling 3D support.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.522] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.293] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.151] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.046] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.496] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.779] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.772] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.670] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.044] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.221] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): vram: 4194304
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.928] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.203] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.961] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.766] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.014] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.715] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.078] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.234] (==) vmware(0): DPI set to (96, 96)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.144] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.012] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.579] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.621] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.297] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.080] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.746] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 203.355] (II) LoadModule: "vmware"
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.880] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.588] (==) vmware(0): Backing store enabled
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.792] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.503] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.785] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.439] (--) vmware(0): depth: 24
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.904] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.878] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.033] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.416] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.805] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.581] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.708] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.753] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.985] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.602] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.424] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.033] (EE) vmware(0): Failed to open drm.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.647] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.035] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.142] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.836] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.683] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.507] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.677] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.306] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 211.998] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.587] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.213] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.246] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.983] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Using HW cursor
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:15 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.595] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.117] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.150] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.563] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (EE) vmware(0): Failed to open drm.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.903] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.445] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Aqua.arm5.elf, 5548.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp Binary or memory string: PV/tmp/qemu-open.xF2MeH:u
Source: Aqua.arm5.elf, 5548.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp, Aqua.arm5.elf, 5552.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.587] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.179] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.929] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 203.319] (==) Matched vmware as autoconfigured driver 0
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.410] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.728] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:15 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.560] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.212] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.104] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.544] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.812] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Aqua.arm5.elf, 5548.1.00005650192aa000.00005650193d8000.rw-.sdmp, Aqua.arm5.elf, 5552.1.00005650192aa000.00005650193d8000.rw-.sdmp Binary or memory string: PV!/etc/qemu-binfmt/arm
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.430] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.110] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.073] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.759] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.628] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.105] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Aqua.arm5.elf, 5548.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp Binary or memory string: /tmp/qemu-open.xF2MeH
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.169] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.771] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.569] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.614] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.494] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.281] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.304] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.020] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.553] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.872] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.470] (--) vmware(0): mheig: 885
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.288] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.378] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.843] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.594] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.959] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.859] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.065] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.385] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.970] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.067] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.099] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.098] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.188] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.232] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Aqua.arm5.elf, 5552.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.181] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.053] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.229] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.269] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.351] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.476] (--) vmware(0): depth: 24
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.002] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): mwidt: 1176
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.425] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.452] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.706] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.125] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.501] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.996] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.300] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.052] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.818] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.611] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.805] (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.147] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.520] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.206] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.667] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.867] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.596] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.475] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:16 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.792] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.194] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 203.854] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.059] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.910] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.464] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.544] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.865] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.257] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.861] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.680] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.488] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.825] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.561] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.445] (--) vmware(0): bpp: 32
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.511] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.494] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.654] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.026] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.092] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:15 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.746] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.345] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.849] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Aqua.arm5.elf, 5548.1.00005650192aa000.00005650193d8000.rw-.sdmp, Aqua.arm5.elf, 5552.1.00005650192aa000.00005650193d8000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.700] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.908] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.739] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.639] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.658] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.726] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.855] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr Binary or memory string: [ 206.786] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.072] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr Binary or memory string: [ 212.477] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.146.dr Binary or memory string: [ 208.086] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.404] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.67.dr Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.146.dr Binary or memory string: [ 207.275] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)

Language, Device and Operating System Detection
barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982) Logged in records file read: /var/log/wtmp

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
89.190.156.145
 unknown United Kingdom
7489 HOSTUS-GLOBAL-ASHostUSHK false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true
45.148.10.84 unknown unknown