Edit tour

Linux Analysis Report
Aqua.arm5.elf

Overview

General Information

Sample name:	Aqua.arm5.elf
Analysis ID:	1580706
MD5:	02ef5e852076cf9c563fbaa180646c85
SHA1:	ec96ee7b457856f00fe02fe4c5579617f4adc054
SHA256:	3d7d516288e90fb68be50e151604f949215d982538d3d53cbfce723fe24a35f4
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580706
Start date and time:	2024-12-25 17:43:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.arm5.elf
Detection:	MAL
Classification:	mal72.spre.troj.evad.linELF@0/107@122/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/Aqua.arm5.elf
PID:	5548
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.arm5.elf (PID: 5548, Parent: 5468, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Aqua.arm5.elf

Aqua.arm5.elf New Fork (PID: 5550, Parent: 5548)

Aqua.arm5.elf New Fork (PID: 5552, Parent: 5550)

gnome-session-binary New Fork (PID: 5554, Parent: 1498)

sh (PID: 5554, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5554, Parent: 1498, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5559, Parent: 1)

systemd-hostnamed (PID: 5559, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 5707, Parent: 1333)

Default (PID: 5707, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5711, Parent: 1333)

Default (PID: 5711, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5712, Parent: 1333)

Default (PID: 5712, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5717, Parent: 1)

dbus-daemon (PID: 5717, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5730, Parent: 3044)

pulseaudio (PID: 5730, Parent: 3044, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5731, Parent: 1)

systemd-logind (PID: 5731, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5790, Parent: 1)

rtkit-daemon (PID: 5790, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5791, Parent: 1)

rsyslogd (PID: 5791, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5794, Parent: 1)

polkitd (PID: 5794, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

gvfsd-fuse New Fork (PID: 5798, Parent: 3210)

fusermount (PID: 5798, Parent: 3210, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5805, Parent: 1)

agetty (PID: 5805, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5808, Parent: 1)

gpu-manager (PID: 5808, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5809, Parent: 5808)

sh (PID: 5809, Parent: 5808, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5810, Parent: 5809)

grep (PID: 5810, Parent: 5809, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5813, Parent: 5808)

sh (PID: 5813, Parent: 5808, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5814, Parent: 5813)

grep (PID: 5814, Parent: 5813, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5811, Parent: 1)

dbus-daemon (PID: 5811, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5815, Parent: 1)

rsyslogd (PID: 5815, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5816, Parent: 1)

agetty (PID: 5816, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5817, Parent: 1)

generate-config (PID: 5817, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5818, Parent: 5817)

pkill (PID: 5818, Parent: 5817, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5824, Parent: 1)

systemd-logind (PID: 5824, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5881, Parent: 1)

gdm-wait-for-drm (PID: 5881, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5905, Parent: 1)

rsyslogd (PID: 5905, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5906, Parent: 1)

agetty (PID: 5906, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5914, Parent: 1)

dbus-daemon (PID: 5914, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5918, Parent: 1)

systemd-logind (PID: 5918, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5978, Parent: 1)

gdm3 (PID: 5978, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5981, Parent: 5978)

plymouth (PID: 5981, Parent: 5978, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5995, Parent: 5978)

gdm-session-worker (PID: 5995, Parent: 5978, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6001, Parent: 5995)

gdm-wayland-session (PID: 6001, Parent: 5995, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6005, Parent: 6001)

dbus-run-session (PID: 6005, Parent: 6001, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6006, Parent: 6005)

dbus-daemon (PID: 6006, Parent: 6005, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 6010, Parent: 6006)

dbus-daemon New Fork (PID: 6011, Parent: 6010)

false (PID: 6011, Parent: 6010, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6013, Parent: 6006)

dbus-daemon New Fork (PID: 6014, Parent: 6013)

false (PID: 6014, Parent: 6013, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6015, Parent: 6006)

dbus-daemon New Fork (PID: 6016, Parent: 6015)

false (PID: 6016, Parent: 6015, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6017, Parent: 6006)

dbus-daemon New Fork (PID: 6018, Parent: 6017)

false (PID: 6018, Parent: 6017, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6019, Parent: 6006)

dbus-daemon New Fork (PID: 6020, Parent: 6019)

false (PID: 6020, Parent: 6019, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6021, Parent: 6006)

dbus-daemon New Fork (PID: 6022, Parent: 6021)

false (PID: 6022, Parent: 6021, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6024, Parent: 6006)

dbus-daemon New Fork (PID: 6025, Parent: 6024)

false (PID: 6025, Parent: 6024, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 6007, Parent: 6005)

gnome-session (PID: 6007, Parent: 6005, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 6007, Parent: 6005, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 6026, Parent: 6007)

session-migration (PID: 6026, Parent: 6007, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 6029, Parent: 6007)

sh (PID: 6029, Parent: 6007, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6029, Parent: 6007, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 6035, Parent: 5978)

gdm-session-worker (PID: 6035, Parent: 5978, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6040, Parent: 6035)

gdm-x-session (PID: 6040, Parent: 6035, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 6042, Parent: 6040)

Xorg (PID: 6042, Parent: 6040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 6042, Parent: 6040, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 6042, Parent: 6040, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 6051, Parent: 6042)

sh (PID: 6051, Parent: 6042, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6052, Parent: 6051)

xkbcomp (PID: 6052, Parent: 6051, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6293, Parent: 6042)

sh (PID: 6293, Parent: 6042, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6294, Parent: 6293)

xkbcomp (PID: 6294, Parent: 6293, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 6057, Parent: 6040)

Default (PID: 6057, Parent: 6040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 6058, Parent: 6040)

dbus-run-session (PID: 6058, Parent: 6040, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6059, Parent: 6058)

dbus-daemon (PID: 6059, Parent: 6058, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 6073, Parent: 6059)

dbus-daemon New Fork (PID: 6074, Parent: 6073)

at-spi-bus-launcher (PID: 6074, Parent: 6073, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 6079, Parent: 6074)

dbus-daemon (PID: 6079, Parent: 6074, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6454, Parent: 6079)

dbus-daemon New Fork (PID: 6455, Parent: 6454)

at-spi2-registryd (PID: 6455, Parent: 6454, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 6101, Parent: 6059)

dbus-daemon New Fork (PID: 6102, Parent: 6101)

false (PID: 6102, Parent: 6101, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6104, Parent: 6059)

dbus-daemon New Fork (PID: 6105, Parent: 6104)

false (PID: 6105, Parent: 6104, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6106, Parent: 6059)

dbus-daemon New Fork (PID: 6107, Parent: 6106)

false (PID: 6107, Parent: 6106, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6108, Parent: 6059)

dbus-daemon New Fork (PID: 6109, Parent: 6108)

false (PID: 6109, Parent: 6108, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6110, Parent: 6059)

dbus-daemon New Fork (PID: 6111, Parent: 6110)

false (PID: 6111, Parent: 6110, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6112, Parent: 6059)

dbus-daemon New Fork (PID: 6113, Parent: 6112)

false (PID: 6113, Parent: 6112, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6115, Parent: 6059)

dbus-daemon New Fork (PID: 6116, Parent: 6115)

false (PID: 6116, Parent: 6115, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6295, Parent: 6059)

dbus-daemon New Fork (PID: 6296, Parent: 6295)

ibus-portal (PID: 6296, Parent: 6295, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6471, Parent: 6059)

dbus-daemon New Fork (PID: 6472, Parent: 6471)

gjs (PID: 6472, Parent: 6471, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6689, Parent: 6059)

dbus-daemon New Fork (PID: 6690, Parent: 6689)

false (PID: 6690, Parent: 6689, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 6060, Parent: 6058)

gnome-session (PID: 6060, Parent: 6058, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 6060, Parent: 6058, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 6061, Parent: 6060)

gnome-session-check-accelerated (PID: 6061, Parent: 6060, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 6080, Parent: 6061)

gnome-session-check-accelerated-gl-helper (PID: 6080, Parent: 6061, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 6090, Parent: 6061)

gnome-session-check-accelerated-gles-helper (PID: 6090, Parent: 6061, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 6117, Parent: 6060)

session-migration (PID: 6117, Parent: 6060, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 6118, Parent: 6060)

sh (PID: 6118, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6118, Parent: 6060, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6260, Parent: 6118)

ibus-daemon (PID: 6260, Parent: 6118, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6289, Parent: 6260)

ibus-memconf (PID: 6289, Parent: 6260, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6291, Parent: 6260)

ibus-daemon New Fork (PID: 6292, Parent: 6291)

ibus-x11 (PID: 6292, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6501, Parent: 6260)

ibus-engine-simple (PID: 6501, Parent: 6260, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6486, Parent: 6060)

sh (PID: 6486, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6486, Parent: 6060, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6488, Parent: 6060)

sh (PID: 6488, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6488, Parent: 6060, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6491, Parent: 6060)

sh (PID: 6491, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6491, Parent: 6060, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6492, Parent: 6060)

sh (PID: 6492, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6492, Parent: 6060, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6493, Parent: 6060)

sh (PID: 6493, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6493, Parent: 6060, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6523, Parent: 6493)

gsd-print-notifications New Fork (PID: 6524, Parent: 6523)

gsd-printer (PID: 6524, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6494, Parent: 6060)

sh (PID: 6494, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6494, Parent: 6060, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6495, Parent: 6060)

sh (PID: 6495, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6495, Parent: 6060, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6498, Parent: 6060)

sh (PID: 6498, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6498, Parent: 6060, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6499, Parent: 6060)

sh (PID: 6499, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6499, Parent: 6060, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6502, Parent: 6060)

sh (PID: 6502, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6502, Parent: 6060, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6505, Parent: 6060)

sh (PID: 6505, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6505, Parent: 6060, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6508, Parent: 6060)

sh (PID: 6508, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6508, Parent: 6060, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6510, Parent: 6060)

sh (PID: 6510, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6510, Parent: 6060, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6513, Parent: 6060)

sh (PID: 6513, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6513, Parent: 6060, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6798, Parent: 6060)

sh (PID: 6798, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6798, Parent: 6060, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6815, Parent: 6060)

sh (PID: 6815, Parent: 6060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6815, Parent: 6060, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 6036, Parent: 5978)

Default (PID: 6036, Parent: 5978, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6037, Parent: 5978)

Default (PID: 6037, Parent: 5978, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5982, Parent: 1)

accounts-daemon (PID: 5982, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5986, Parent: 5982)

language-validate (PID: 5986, Parent: 5982, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5987, Parent: 5986)

language-options (PID: 5987, Parent: 5986, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5988, Parent: 5987)

sh (PID: 5988, Parent: 5987, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5989, Parent: 5988)

locale (PID: 5989, Parent: 5988, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5990, Parent: 5988)

grep (PID: 5990, Parent: 5988, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5991, Parent: 1)

polkitd (PID: 5991, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6003, Parent: 1431)

dbus-daemon (PID: 6003, Parent: 1431, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6140, Parent: 1)

systemd-localed (PID: 6140, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6303, Parent: 1)

upowerd (PID: 6303, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6343, Parent: 1431)

pulseaudio (PID: 6343, Parent: 1431, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6346, Parent: 1)

geoclue (PID: 6346, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6451, Parent: 1)

rtkit-daemon (PID: 6451, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6464, Parent: 1)

wpa_supplicant (PID: 6464, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6465, Parent: 1)

avahi-daemon (PID: 6465, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6466, Parent: 6465)

systemd New Fork (PID: 6469, Parent: 1)

packagekitd (PID: 6469, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6490, Parent: 6469)

dpkg (PID: 6490, Parent: 6469, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6529, Parent: 1)

systemd-hostnamed (PID: 6529, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6716, Parent: 1)

colord (PID: 6716, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6793, Parent: 6716)

colord-sane (PID: 6793, Parent: 6716, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6743, Parent: 1)

ModemManager (PID: 6743, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6778, Parent: 3044)

dbus-daemon (PID: 6778, Parent: 3044, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6779, Parent: 3044)

pulseaudio (PID: 6779, Parent: 3044, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6816, Parent: 1)

fprintd (PID: 6816, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Aqua.arm5.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Aqua.arm5.elf	ReversingLabs: Detection: 42%
Source: Aqua.arm5.elf	Virustotal: Detection: 38%			Perma Link

Source: /usr/bin/pkill (PID: 5818)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6080)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6343)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6779)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: Aqua.arm5.elf

String: EOF/proc//proc/%s/cmdlinerwgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Source: global traffic

TCP traffic: 192.168.2.15:37424 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 5791)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5815)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5905)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5978)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6006)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6007)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6060)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 6260)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: 45.148.10.84
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: syslog.67.dr, Xorg.0.log.146.dr	String found in binary or memory: http://wiki.x.org
Source: syslog.67.dr, Xorg.0.log.146.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.67.dr, syslog.35.dr, syslog.55.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 1679, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5554, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 723, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 724, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 779, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 796, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 1440, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 3060, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5532, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5533, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5717, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5730, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5791, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5805, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5808, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 3047, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5811, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5815, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5816, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	SIGKILL sent: pid: 6073, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	SIGKILL sent: pid: 6454, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 1679, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5554, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 723, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 724, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 779, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 796, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 1440, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 3060, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5532, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5533, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5717, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5730, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5791, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5805, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5808, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 3047, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5811, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5815, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 5552)	SIGKILL sent: pid: 5816, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	SIGKILL sent: pid: 6073, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	SIGKILL sent: pid: 6454, result: successful	Jump to behavior

Source: classification engine

Classification label: mal72.spre.troj.evad.linELF@0/107@122/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5717)	File: /proc/5717/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5798)	File: /proc/5798/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5811)	File: /proc/5811/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5914)	File: /proc/5914/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6006)	File: /proc/6006/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File: /proc/6059/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File: /proc/6079/mounts	Jump to behavior
Source: /usr/bin/gjs (PID: 6472)	File: /proc/6472/mounts	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118)	File: /proc/6118/mounts
Source: /usr/bin/dbus-daemon (PID: 6003)	File: /proc/6003/mounts
Source: /usr/bin/dbus-daemon (PID: 6778)	File: /proc/6778/mounts

Source: /usr/libexec/gsd-rfkill (PID: 5554)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5554)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5559)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5731)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5731)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5731)	File: /run/systemd/seats/.#seat00bKj5v	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5794)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5824)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5824)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5824)	File: /run/systemd/seats/.#seat0aWx1rC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/seats/.#seat0vNzIAG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127d0hA7G	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127dZcUBF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c15YluFH	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127PZOo6G	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/seats/.#seat0mzw6OI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#1271IdlrI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c1SQVpXI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c1eG8dzI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127AfItbG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/seats/.#seat06bxeTI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c145ZkLI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127nBMILF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c1q6pdXI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c1swftzI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c1lEZWSG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127wom63G	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/seats/.#seat0bDf9lF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127Kta8GI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/seats/.#seat0XmrqJE	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127jfCEOI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/seats/.#seat0QNkJIH	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#1275Em6EF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c2wz7PrG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#1277LDHAI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/seats/.#seat0XzcaBI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c20BO4sF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c2qGsSDG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/users/.#127MuOcoI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c2GMeBkG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c2dzB76F	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c2oMAgNI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c2VBsTPG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/sessions/.#c2bPQHbG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/inhibit/.#1aytZsF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/inhibit/.#2t9Sc1I	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/inhibit/.#3i3aUvI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/inhibit/.#4EuBOhG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5918)	File: /run/systemd/inhibit/.#5gzYi4G	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6029)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6029)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6080)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6118)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 6118)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6118)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 6118)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 6118)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 6118)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6292)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6292)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6488)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6488)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6491)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6491)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6492)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6492)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6494)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6494)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6513)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6513)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 5991)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6303)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6303)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6469)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6529)	Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6716)	Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6743)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6743)	Directory: <invalid fd (11)>/..

Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6079/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6079/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6455/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6488/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6499/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6090/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6061/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6292/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6492/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6491/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6513/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File opened: /proc/6118/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6296/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6472/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6494/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6493/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6495/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6498/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6499/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6510/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6455/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6059/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6059/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6074/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6492/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6491/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6524/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6502/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6505/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6508/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6486/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6488/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6061/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6060/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6060/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6260/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6513/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6059)	File opened: /proc/6118/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717)	File opened: /proc/5790/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717)	File opened: /proc/5794/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717)	File opened: /proc/5730/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717)	File opened: /proc/5717/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717)	File opened: /proc/5717/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5717)	File opened: /proc/5731/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5385/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5385/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5816/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5816/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5817/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5817/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5818/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5818/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/911/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/911/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5811/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5811/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/914/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/914/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5812/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5812/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5815/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/5815/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5818)	File opened: /proc/17/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5809)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5813)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6051)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6293)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5988)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5810)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5814)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5990)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5818)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5805)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5816)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5906)	Reads version info: /etc/issue	Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5978)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5978)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5791)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5791)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5815)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5815)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5905)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5905)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 6042)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.arm5.elf (PID: 5550)

File: /tmp/Aqua.arm5.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5808)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042)	Truncated file: /var/log/Xorg.pid-6042.log			Jump to behavior

Source: /usr/bin/pkill (PID: 5818)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6080)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6343)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6779)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/Aqua.arm5.elf (PID: 5548)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5559)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5791)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5805)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5815)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5816)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5905)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5906)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5995)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6007)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6035)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 6040)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6042)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 6074)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 6455)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6060)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6061)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6080)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6090)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6118)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6292)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6488)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6491)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6492)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6495)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6499)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6513)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6343)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6465)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6469)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6529)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6793)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6779)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6816)	Queries kernel information via 'uname':

Source: Xorg.0.log.146.dr	Binary or memory string: [ 203.674] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.175] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.695] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.885] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.673] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.130] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.976] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.326] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.891] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.458] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.047] (WW) vmware(0): Disabling 3D support.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.141] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.156] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.845] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.534] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.391] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.608] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.442] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.506] (--) vmware(0): vis: 4
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.199] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.526] (==) vmware(0): Default visual is TrueColor
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.965] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.240] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.752] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.449] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.799] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.167] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.066] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.481] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.085] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.056] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.601] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.398] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.312] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.190] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.365] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.458] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.923] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.208] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.456] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.123] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.529] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.921] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.811] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.468] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.713] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.721] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.257] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.227] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.119] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.163] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:16 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.720] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.173] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.186] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 203.452] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.999] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.972] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.601] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 211.991] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.196] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.686] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.607] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.55.dr	Binary or memory string: Dec 25 10:44:45 galassia kernel: [ 172.417661] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp parport drm ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper mptspi scsi_transport_spi psmouse mptscsih mptbase ahci libahci vmxnet3
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.507] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.799] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.953] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.550] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.546] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.171] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.989] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.874] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.137] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.112] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.054] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.702] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.462] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.654] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.759] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.637] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.008] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Default visual is TrueColor
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.217] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.290] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.765] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.566] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): depth: 24
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): vis: 4
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.917] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 203.379] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.649] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.591] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.193] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.693] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.319] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.664] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.026] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.131] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.520] (==) vmware(0): RGB weight 888
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.224] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.916] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.643] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.513] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.556] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.992] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.201] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.358] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.059] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.061] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.947] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.626] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.621] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.912] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.452] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.154] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.371] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.938] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.264] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.005] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.238] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.019] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.660] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.55.dr	Binary or memory string: Dec 25 10:44:45 galassia kernel: [ 172.417679] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.509] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.335] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.537] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.538] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.575] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.899] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.689] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.252] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.826] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.526] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.887] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.779] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.852] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.573] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.500] (--) vmware(0): w.blu: 8
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.616] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.898] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.893] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.482] (--) vmware(0): bpp: 32
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:15 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) LoadModule: "vmware"
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (WW) vmware(0): Disabling 3D support.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.522] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.293] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.151] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.046] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.496] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.779] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.772] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.670] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.044] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.221] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): vram: 4194304
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.928] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.203] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.961] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.766] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.014] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.715] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.078] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.234] (==) vmware(0): DPI set to (96, 96)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.144] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.012] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.579] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.621] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.297] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.080] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.746] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 203.355] (II) LoadModule: "vmware"
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.880] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.588] (==) vmware(0): Backing store enabled
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.792] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.503] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.785] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.439] (--) vmware(0): depth: 24
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.904] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.878] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.033] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.416] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.805] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.581] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.708] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.753] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.985] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.602] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.424] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.033] (EE) vmware(0): Failed to open drm.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.647] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.035] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.142] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.836] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.683] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.507] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.677] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.306] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 211.998] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.587] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.213] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.246] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.983] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Using HW cursor
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:15 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.595] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.117] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.150] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.563] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (EE) vmware(0): Failed to open drm.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.903] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.445] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Aqua.arm5.elf, 5548.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp	Binary or memory string: PV/tmp/qemu-open.xF2MeH:u
Source: Aqua.arm5.elf, 5548.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp, Aqua.arm5.elf, 5552.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.587] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.179] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.929] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 203.319] (==) Matched vmware as autoconfigured driver 0
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.410] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.728] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:15 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.560] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.212] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.104] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.544] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.812] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Aqua.arm5.elf, 5548.1.00005650192aa000.00005650193d8000.rw-.sdmp, Aqua.arm5.elf, 5552.1.00005650192aa000.00005650193d8000.rw-.sdmp	Binary or memory string: PV!/etc/qemu-binfmt/arm
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.430] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.110] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.073] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.759] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.628] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.105] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Aqua.arm5.elf, 5548.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.xF2MeH
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.169] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.771] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.569] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.614] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.494] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.281] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.304] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.020] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.553] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.872] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.470] (--) vmware(0): mheig: 885
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.288] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.378] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.843] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.594] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.959] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.859] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.065] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.385] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.970] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.067] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.099] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.098] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.188] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.232] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Aqua.arm5.elf, 5552.1.00007ffdcbc2b000.00007ffdcbc4c000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.181] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.053] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.229] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.269] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.351] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.476] (--) vmware(0): depth: 24
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.002] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): mwidt: 1176
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.425] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.452] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.706] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.125] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.501] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.996] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.300] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.052] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.818] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.611] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.805] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.147] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.520] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.206] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.667] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.867] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.596] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.475] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:16 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.792] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.194] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 203.854] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.059] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.910] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.464] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.544] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.865] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.257] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.861] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.680] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.488] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.825] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.561] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.445] (--) vmware(0): bpp: 32
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.511] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.494] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.654] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.026] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.092] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:15 galassia /usr/lib/gdm3/gdm-x-session[6042]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:20 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.746] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.345] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.849] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Aqua.arm5.elf, 5548.1.00005650192aa000.00005650193d8000.rw-.sdmp, Aqua.arm5.elf, 5552.1.00005650192aa000.00005650193d8000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.700] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.908] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:18 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.739] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.639] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.658] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.726] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.855] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 206.786] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:19 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.072] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.146.dr	Binary or memory string: [ 212.477] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.146.dr	Binary or memory string: [ 208.086] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.404] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Dec 25 10:45:24 galassia /usr/lib/gdm3/gdm-x-session[6042]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.146.dr	Binary or memory string: [ 207.275] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5982)

Logged in records file read: /var/log/wtmp

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.arm5.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
Aqua.arm5.elf	38%	Virustotal		Browse
Aqua.arm5.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
45.148.10.84	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.67.dr, syslog.35.dr, syslog.55.dr	false	high
http://wiki.x.org	syslog.67.dr, Xorg.0.log.146.dr	false	high
http://www.ubuntu.com/support)	syslog.67.dr, Xorg.0.log.146.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.190.156.145	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86_64.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	kqibeps.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.x86_64.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ngwa5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	kqibeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6011/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6014/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6016/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6018/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6020/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6022/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6025/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6074/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6102/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6105/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6107/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6109/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6111/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6113/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6116/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6296/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6455/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6472/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6690/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:I:I
MD5:	6BC92FB54D6B27BB11495D88235A9D65
SHA1:	C205B307DBACF4F4CCB444FA1469B236AD8A0945
SHA-256:	55DF085D41FA16C207A1C565A41B9EF6E3B88B8F1CFAFB153A7B0ABE987A0E33
SHA-512:	4EC6DD364E0E5BFF0DB90F9CB1982ED69855F6F7FC1E9A776C060B09B7C309D30D238FF1198F5206BB5A7D0138BBCC4A37C2844B3BE9289FA28C362178921677
Malicious:	false
Preview:	6465.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:JSt:O
MD5:	E776C89A85EDDCCF116D25058B23148A
SHA1:	71C91E720E7159A3B021F8F3426699B70BD5F9C4
SHA-256:	8C9798C4F6273C2FF1A7D09EAB3643D36C819CE8D0C0F23E4D1126397E79425E
SHA-512:	4F7C306901557C8648E3E0E70CBE00325EBD912F90C1BA67C358866ACD904558B8EBD55042DE161502B5A8749CF2FF23D6505BED20643A9F0C10A7E488943581
Malicious:	false
Preview:	5978.

/run/systemd/inhibit/.#1aytZsF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifJWq3IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfJWq3ApLHK7wR9n
MD5:	517575546352608B32EA65E5B0A94C8E
SHA1:	2399E708B3300B63D84706EA98D5C8120F3E341C
SHA-256:	2A4BB3DB8CD5F4AC60D9440C173A91CEBD26D2F64DEEBD871D3850DE7F4392F1
SHA-512:	AA6BFFB939D3709DE1A3857B305732481361B5138C346864B5C13BA60A5CFB526EB9F9A872B71128B12AA86A2376EE917C28B1B54833FC2A4AC48D2832D2A289
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6303.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2t9Sc1I

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.2194016554059095
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+IqKLXv0Rsz:qgFqXQXTI1IlhqKjcRsz
MD5:	25F12CDE6C0C757F33C2B4614D1C5712
SHA1:	69893312922800F63A900DA25991F3682295839B
SHA-256:	11A05D598B0F84C5E8FFBE9CE50C929682E8DFB2E07AA473DA0E1D44F4166A26
SHA-512:	9C78DE57028FF872E0193F0385C6B265F4C7170ED97053BC598CC729F28D412A109CA184E43B40420788153EF53C475DA4B08FDAE27A9ECFC460F99269782CC1
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6499.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3i3aUvI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.180533233946161
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++dfiXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+IqKLXv0RT
MD5:	3DF528100BEF8A9A821792AABD82180E
SHA1:	4E44C1593798E8DBC41F15DCC68E7810C72AAF56
SHA-256:	502F6D6F33F0C994830B4E8D208EE0D3F393D354A40B7586E76771BE9BC202CF
SHA-512:	4BB59223C17301511E219D5C69CBC3FD6BE491820D51F6AED3F82A376FDDD6AE4CB935F51CE5D212B21D22FDD1DFC988742C6E149B1E92774016C0CE10B3C49F
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6499.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4EuBOhG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.165199761184817
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++qVY4iXulpv5RX8/SflY:SbFuFyL8OAAx+/NlpLRS
MD5:	C5EC5E71AEF74374D5A1F946F04F7E8E
SHA1:	5CED5348FF831A6E48E98D43DDACFEDBAAD8C7EC
SHA-256:	B9B72948F15FEED2A6D2C2498EF9DE0A106C783FB56F8C4331FD44B355E5CD75
SHA-512:	6A07FA12ED666CB9857271AECF7C9973F626BBE468044DEBA7F93D7EBA94B644C6765E5FB8D61FF56FDE5091F2611E32C444DD2AB9D2CF803CD502507099460E
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6513.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/inhibit/.#5gzYi4G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.986393731004737
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifLDkBoDWicRF2Tg+tX8/Sf5:SbFuFyL8OAApfLDjDJcjKR5
MD5:	B012E057B72F7CCF7C5BF7C9F99DD5CF
SHA1:	E8BB988F780BD4E6BEE4DFA8454F85EE0EBF3DA6
SHA-256:	F6FFE433FB7CA2FB406963F8416127474C0F6BEB7F25A844BED4F550B563F5B2
SHA-512:	B113B554ED769B5DEC9B0050DC8F1DDB34C7C37EC78CDE3C84E18981231B598A268E64F3F19CB2F701F9CD7C6FA5E2CC6050E7184A64BAF335927CA595C1B069
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6743.WHO=ModemManager.WHY=ModemManager needs to reset devices.FIFO=/run/systemd/inhibit/5.ref.

/run/systemd/seats/.#seat00bKj5v

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat06bxeTI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0QNkJIH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0XmrqJE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0XzcaBI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0aWx1rC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0bDf9lF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0mzw6OI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0vNzIAG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/sessions/.#c145ZkLI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.4166068842077655
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBRJgq8Wv:qgFqPuFN6IG0n99x2xayWRJgqH
MD5:	659F197337EE56C8A8470A882DC0BE5D
SHA1:	A589EAA8EAA424A2F1E8337430EA1CD2DD385B65
SHA-256:	646F754489B3403D4AB096F3A793AE98A8B3673A7674C6308D74F41C2A9423C0
SHA-512:	F044A634ADD56A3A3E509367C124C6CC4BAD7D028AA4E8834418D52F20871489A0321C7FE4B98B4E08830141E306D314BE0B4B57D7A30473A6ED116054532C79
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5995.REALTIME=1735145105196600.MONOTONIC=192800870.

/run/systemd/sessions/.#c15YluFH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.484828583684972
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedVuRmUKBhcIS3xff6Hxfx2xNIByy6GBRJgq8Wv:qgFqPumVuRZI4BW9x2xayWRJgqH
MD5:	89973641EE03DA188360F4749C8FFE9C
SHA1:	7661756EE88AB8FF082205F75574ECF78C9BC3D0
SHA-256:	E7675BF2F6E599C27000F6D50DA9043942D372F7C8D524A5E5A4A4EF48857949
SHA-512:	AC82A4628BED5948CF5857CAA49EB15E0A4F2CF0C9624B788802FE5D49DAE1D44FF055E06C13D95D671320178C9E9329F47C0630B92037061B884A8E6D589B4B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8639.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5995.REALTIME=1735145105196600.MONOTONIC=192800870.

/run/systemd/sessions/.#c1SQVpXI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.415214644953121
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBRJgq8Wv:qgFqPumW8IG0n99x2xayWRJgqH
MD5:	05FFFE29103B6C120C46F60A467CF73A
SHA1:	7B671094921CB47BFDDDDE478A0B2D53296690BF
SHA-256:	C38C4F50075736EB11A4E67222061CB551C001F658193105114DA03B145B54E3
SHA-512:	3474956D404C1054A613B83F96A7EDBC66B78E0DF7C086DCF0766DE1D9A022EC825CD865A38A01784B8D4F1C6DFC5900B7E19CA89054E6C3865A78AA58A565FA
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5995.REALTIME=1735145105196600.MONOTONIC=192800870.

/run/systemd/sessions/.#c1eG8dzI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.415214644953121
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBRJgq8Wv:qgFqPumW8IG0n99x2xayWRJgqH
MD5:	05FFFE29103B6C120C46F60A467CF73A
SHA1:	7B671094921CB47BFDDDDE478A0B2D53296690BF
SHA-256:	C38C4F50075736EB11A4E67222061CB551C001F658193105114DA03B145B54E3
SHA-512:	3474956D404C1054A613B83F96A7EDBC66B78E0DF7C086DCF0766DE1D9A022EC825CD865A38A01784B8D4F1C6DFC5900B7E19CA89054E6C3865A78AA58A565FA
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5995.REALTIME=1735145105196600.MONOTONIC=192800870.

/run/systemd/sessions/.#c1lEZWSG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.373149733276396
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBRJgq8Wv:qgFqPuFdDJIi9x2xayWRJgqH
MD5:	1AEF5145C2227B334072C6741DD1EC6F
SHA1:	48AD7BCB2CF61C50F06F2468255553218AB95790
SHA-256:	7484BD3B2B4178140BF76422622ABC128DD6439AFB15C02C39C0C95FA3794CA0
SHA-512:	1B878DF59ABF53D5DE51A13B387AEDB55794920175D18BADF10E5D42E8C16770FA511F23E71166C06BB062356053E197C533CC50AEE9AE0937EC8E3CBE486C23
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5995.REALTIME=1735145105196600.MONOTONIC=192800870.

/run/systemd/sessions/.#c1q6pdXI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.420136865579537
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBRJgq8WXd:qgFqPuFN6IG0n99x2xayWRJgq/d
MD5:	0FB8E4101FC7EA7B090F150304E25DCE
SHA1:	43C972E9E9D18975D66802D27E34661E0131003D
SHA-256:	5483920A7D3F3BC65A293D70604F2F16DB7EE5961775BD357BDE29BCAA14EE0B
SHA-512:	C689B09BBFB7D42CF7278C1A3FDDC5F59A4898DF31E8349FF6052C0E744D46FD695C0C156BFA5463F070C8BA3B7B0813DF34C7E26241619ECD35542065FD6BA2
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5995.REALTIME=1735145105196600.MONOTONIC=192800870.CONTROLLER=:1.11.

/run/systemd/sessions/.#c1swftzI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.4166068842077655
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBRJgq8Wv:qgFqPuFN6IG0n99x2xayWRJgqH
MD5:	659F197337EE56C8A8470A882DC0BE5D
SHA1:	A589EAA8EAA424A2F1E8337430EA1CD2DD385B65
SHA-256:	646F754489B3403D4AB096F3A793AE98A8B3673A7674C6308D74F41C2A9423C0
SHA-512:	F044A634ADD56A3A3E509367C124C6CC4BAD7D028AA4E8834418D52F20871489A0321C7FE4B98B4E08830141E306D314BE0B4B57D7A30473A6ED116054532C79
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5995.REALTIME=1735145105196600.MONOTONIC=192800870.

/run/systemd/sessions/.#c20BO4sF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.415676192936041
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB7fJgoH/MJ:qgFqPuFNuCH0nI9x2xayW7fJgF
MD5:	D4A5F757D8A249E05390BDCCC0A28156
SHA1:	D7A3D280704858A55DC200F9D3561ECA6A91B64E
SHA-256:	402584CC5423F6E36BA27C4EACB3726E880DCE8AD6AB806F26DF0DFB02494F55
SHA-512:	7A943E5E2C5E29430562CD6C16A5757AD576BCBD94B4CB45CDAEA94269910183BD2D6F6C3BF0510E3C615E796E978D6FCF1E7C257E18F8B9A5F0660B9961AD51
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6035.REALTIME=1735145113227975.MONOTONIC=200832244.

/run/systemd/sessions/.#c2GMeBkG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.424153834883682
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB7fJgoH/MVR:qgFqPuFNuCH0nI9x2xayW7fJgJR
MD5:	952D329A7CF2DB1300331E9C3BF42C60
SHA1:	91FC6134B7164969197C79985346C1EAEA6DCCA4
SHA-256:	2FBB97092983FAFEDE9390AB350696788310CBFCFC7732D835BD6FB660F1B712
SHA-512:	3AA776ACB7BDB80DBAB2121E2222BFF233DEC7AC59565D7A768E86C14AF610438F432DD11F0E909DDD823E598D5D110672BAB31C83D70BDA22F195774649AEB7
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6035.REALTIME=1735145113227975.MONOTONIC=200832244.CONTROLLER=:1.15.

/run/systemd/sessions/.#c2VBsTPG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.448913850469237
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB7fJgoH/MVRn:qgFqPuFNuCH0nI9x2xayW7fJgJR
MD5:	8328F0368B5E8A2C2638A0B8F8296024
SHA1:	A01B8514C947D545FDC268E687D90FB2C269F17D
SHA-256:	43CB5B0B99EA044D904BDD3E40EFD2783261B2F4C12B33AF8CBD68053468A11C
SHA-512:	F767EAE538E7B6397BCE2CC25EF70E6BBC0FA86178DDFF016812C9127ABDB054047A868577B722F3B6A7FFCA26C1DE72DE114D3FAF8AF902C467E65DD97BB27C
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6035.REALTIME=1735145113227975.MONOTONIC=200832244.CONTROLLER=:1.15.DEVICES=13:67 13:64 13:65 .

/run/systemd/sessions/.#c2bPQHbG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.452238348569026
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB7fJgoH/MVtFn:qgFqPuFNuCH0nI9x2xayW7fJgJtFn
MD5:	901FDBF6DA1CA7A12461314B65955948
SHA1:	0EFA72BDD64CE5FAB03E3B8ECB6D5CAF15970F3C
SHA-256:	6BCAB5734B0EE68361D5DBD18415F5C156D373981CAAA5F46ED55311176B6420
SHA-512:	5B9F11A0C44E8B085B5A20A213AFED3E375446ACE7B6A4293A87CBDFB4D3A1B5FF8E551C0995AB899E4E65E4469ABD4EA44B9F27085FD911AC200275ED9654D0
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6035.REALTIME=1735145113227975.MONOTONIC=200832244.CONTROLLER=:1.15.DEVICES=13:67 13:64 13:65 13:66 .

/run/systemd/sessions/.#c2dzB76F

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.431387427749732
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB7fJgoH/MVj:qgFqPuFNuCH0nI9x2xayW7fJgJj
MD5:	3E382EEE6D49DCCB037D6B4C44F169AC
SHA1:	E35D206395DAB7594AC010EB42ABCDC7D6656F67
SHA-256:	DB434DE9B052BF1EEC968F2EBEA13120046EE7701C9EB27A8C594CE1B30806F5
SHA-512:	B3D2FB5D99FE05DD2B8DD28B591DB8DB3323B72E97B174F725AC91DF4549F376B00573609EC7ED8797DD456EB6877A0F6F666DB66EC3D6CD3163EF4DF0BD0F15
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6035.REALTIME=1735145113227975.MONOTONIC=200832244.CONTROLLER=:1.15.DEVICES=13:64 .

/run/systemd/sessions/.#c2oMAgNI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.441766502378184
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB7fJgoH/MVKn:qgFqPuFNuCH0nI9x2xayW7fJgJK
MD5:	A47B93404565924B5240AADD44408D1C
SHA1:	94DBD0A1A6BB48C7FDEAA2685E96F39DBEC520E2
SHA-256:	EA1294CFFF154D6DBD02E2C4EF0116CD92E39FDC4EF0B79E989035EB326C6EE1
SHA-512:	AB7B42E41B3F0755AE6991A857988800412531B8D3A9E3768D86BEA43A59DE2AD07B27846511D4E2B2103445C0F698C88610F497E1C7277A8CDA6A35A03300DD
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6035.REALTIME=1735145113227975.MONOTONIC=200832244.CONTROLLER=:1.15.DEVICES=13:64 13:65 .

/run/systemd/sessions/.#c2qGsSDG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.415676192936041
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB7fJgoH/MJ:qgFqPuFNuCH0nI9x2xayW7fJgF
MD5:	D4A5F757D8A249E05390BDCCC0A28156
SHA1:	D7A3D280704858A55DC200F9D3561ECA6A91B64E
SHA-256:	402584CC5423F6E36BA27C4EACB3726E880DCE8AD6AB806F26DF0DFB02494F55
SHA-512:	7A943E5E2C5E29430562CD6C16A5757AD576BCBD94B4CB45CDAEA94269910183BD2D6F6C3BF0510E3C615E796E978D6FCF1E7C257E18F8B9A5F0660B9961AD51
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6035.REALTIME=1735145113227975.MONOTONIC=200832244.

/run/systemd/sessions/.#c2wz7PrG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.4724309257709605
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffU8xfx2xNIByy6GB7fJgoH/MJ:qgFqPuFVuRpCvB79x2xayW7fJgF
MD5:	FF9BDB3E42CAEF42367E3DFE38ACD2C1
SHA1:	D6777E5A1DC50F6F3C4E8CF4FA0EA90E073699BB
SHA-256:	13FD95633201CE9157C1468A39D1BB17580BDBAE6257E03334E10496875A78E2
SHA-512:	8D6DB2F685771CFAC13FA024440D67E3B48AC7F074AE7BC238066B3C78572725346225CF58E6104A0BA8C7DD9965287CC1A122B33D3C5CEA89E41ED0B45460E2
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8702.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6035.REALTIME=1735145113227975.MONOTONIC=200832244.

/run/systemd/users/.#1271IdlrI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.123661042393316
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgQACW8nQ2thQc2pb02/g2p9rwB:qgFq30z1cL/ixegwW8jthQHtPYq9M
MD5:	47921C4950F93C5CAF86209BBCE4DB5E
SHA1:	CDF2910E5C4DBFE50BB9DD5D0DCD2691BC36B1CF
SHA-256:	AAC24D9BC6FFD5AAB4DDDCC09A83B50868AC15FB290D6DA550E1CF4C2918AF31
SHA-512:	759C5AB2B54F4835A4ABAD61848961A21C238DF8EF7A62915C13218F587BEE27D9D8C851EE13CA57024C6055BC0451825ECDB479F4075F5A50FF7805EF32EB4B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1275Em6EF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.123225592439034
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgQACW8nQ2z5c2zw02zb2owB:qgFq30z1cL/iRJgwW8jz5HzwPzbA
MD5:	A2D1EFC2A32029DF7B81CC9FA7C991D9
SHA1:	927BFDF830EF144A55093644D2B6D9A161B60855
SHA-256:	1AEE37513D31E8B091A932B811E1F3A20DBADD2DA96CF76AF3917865C5D8125A
SHA-512:	0917F577E3FC3D5118C67D743960D13471686BC5612687206CA3F4B9E3B704E626A7581813F5F7AA251631E6F941E5B8656A58EF9AAAA48B42DE0EF777C4A1BE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1277LDHAI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.1458388571320715
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgQACW8nQ2z5c2zw02zb2owB:qgFq30z1cL/ixxTgwW8jz5HzwPzbA
MD5:	B976D490E8DD1B5E8478575CDEC7F999
SHA1:	EEBDE753B49B00D31FDEAC36B108437888A1F4D5
SHA-256:	F5EF2EDEA828729B0164B804F700A46EE7EF2D07B737F0418719C872E5D5FABB
SHA-512:	9FDF5FDE416729DF030510421B4CBAB2C812F604B7E5E54D0B19FE0DE4EB75AAEDEEE54EE000C4E3AA5E320C546E64DA75F74AA61D7920C1FEF5A86D35EA2091
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127AfItbG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.123661042393316
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgQACW8nQ2thQc2pb02/g2p9rwB:qgFq30z1cL/ixegwW8jthQHtPYq9M
MD5:	47921C4950F93C5CAF86209BBCE4DB5E
SHA1:	CDF2910E5C4DBFE50BB9DD5D0DCD2691BC36B1CF
SHA-256:	AAC24D9BC6FFD5AAB4DDDCC09A83B50868AC15FB290D6DA550E1CF4C2918AF31
SHA-512:	759C5AB2B54F4835A4ABAD61848961A21C238DF8EF7A62915C13218F587BEE27D9D8C851EE13CA57024C6055BC0451825ECDB479F4075F5A50FF7805EF32EB4B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Kta8GI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.119285259810143
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgQACW8nQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegwW8jthQHtPnmDq9x
MD5:	F6D33D6BFB7CB35F02A14C90A6101018
SHA1:	C384867EFF3B51588FFED8F99AEC14AA5FF7CC6B
SHA-256:	D02835BC7B166B0E7F2279F571F4CBD355AA4DEC794249F182BC39E023C65B7E
SHA-512:	3158314E6F976D9EBD08E44CEE125B51B3B03EA38B2D0A3C912C42741FD701AE97914988B66C580D0CC3D31D1BF8A763DEC321987DCF49A377D585A6A96094C2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127MuOcoI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.129902602151991
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgQACW8nQ2z5c2zw02zb2owB:qgFq30NzL/ixxTgwW8jz5HzwPzbA
MD5:	2F7DE47391E88B161DDB074E06A0B4EA
SHA1:	AB98975454D8EFA718022D8E3777DA2250377686
SHA-256:	F967E7104DDF3477A2C9ECD416A7984B9F52EE893BC6D0F519B792396EEEB074
SHA-512:	6DDE0793814B444ED549FA169734FBE6754C4EAE2F62072D7CA3E68971EFF1E9C0ECCB2927F8F100FC9D5107693921734FC893E1033905D9949C1010D5CCCA38
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127PZOo6G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.28358301725325
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffPaSfgQACW8nQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB3aegwW8jthQHtPYqi
MD5:	B193F772505D756CA621D68376BEDBC4
SHA1:	1BD70621B7C2424750B0990A00F8661AF5B1748B
SHA-256:	A8A9385047FED515499FAA259B461A973AF9B2076BACF6CA19B99464E1B1E41F
SHA-512:	2B576EE6157852042FB1F0C078CAE7A0F6E79C77A2F690FC338186B1DB00B1CE6BC11CA6FA215D0F80A7307EF5D22768F889940A9B5F5D4D5FF5465BB1E749EC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8577.DISPLAY=c1.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127d0hA7G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127dZcUBF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.263253677318608
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffafJgQACW8nQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBKJgwW8jthQHtPYq9M
MD5:	E8AD802E1E6B1E904CBF1D9568466A70
SHA1:	280C19ED16ADF4A96F463D30D4AA032AC276FFFA
SHA-256:	66F36893044E709309B6D83DEDE52E2BAA1C867508BDE22799291C3033378BD4
SHA-512:	C0603195127F2909DCF923B847054002B9EECCBE29426E108B5BD153DEFC374BE28959381D7D865DFD90F7EBC38424D56A1D24DA39D0DE7E40F6145B30582E7B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8577.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127jfCEOI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.119285259810143
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgQACW8nQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegwW8jthQHtPnmDq9x
MD5:	F6D33D6BFB7CB35F02A14C90A6101018
SHA1:	C384867EFF3B51588FFED8F99AEC14AA5FF7CC6B
SHA-256:	D02835BC7B166B0E7F2279F571F4CBD355AA4DEC794249F182BC39E023C65B7E
SHA-512:	3158314E6F976D9EBD08E44CEE125B51B3B03EA38B2D0A3C912C42741FD701AE97914988B66C580D0CC3D31D1BF8A763DEC321987DCF49A377D585A6A96094C2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127nBMILF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.115654031144607
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgQACW8nQ2thQc2x9sS02/g2owB:qgFq30NzL/ixegwW8jthQHxbPYA
MD5:	F318BDFA4FB449316757201C455535E8
SHA1:	62DD3D1F10508D159CAAC2106B95B52A0C6EA83E
SHA-256:	553FDE3C506D3EEBBCA2A35D5C29E64B76E15B026A24A1569E94D7B3C3F9F949
SHA-512:	49D112AD03F8F9CCA335D90F02385F3F05D9C6B84512450AE332FDF45D71636F6D8915E36E7D354B38DFCDE40A5CEDDDEDDE7791896C2F92F89D16ED9CA21E3C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127wom63G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.133357682002731
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgQACW8nQ2thQc2x9sS02nmD2owC:qgFq30dAL/ixegwW8jthQHxbPnmDd
MD5:	FDB4F818F0062E7795B6FB2742040678
SHA1:	43FF34734F2B8355151A80F7A8754FFD965C6540
SHA-256:	AE12619A72144F81BD2CD83F472D36D0CF9A7A2B76CBBDCFEC3E544F2241F10B
SHA-512:	1A0A5296CF94DA50E00AA45D3B16F31B219A98CAC2DA81EE9EB0A59622924DF08B0868B69834313E496BC8B9ED9B74FE98371509E9F0D01C13CF77D230B43D9A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1735145105177221.MONOTONIC=192781491.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Nen:A
MD5:	F5DB257117F666D4E8441A297DB3A6E7
SHA1:	BC4ADF1938E36D92AE56EF434339842160AA4EEB
SHA-256:	771C2DF546FD63848FCA3569A39F0FAF138AB284BA22DAA5F14B6AD0C39909E3
SHA-512:	993C21455EC10128BF80D6288D01B84E4E8C71F0CFC86BEC84E2C442E1F7DBE801231513657B9C850768393CC83739BC9152C46C9EE6E30218AE1F815C4C358E
Malicious:	false
Preview:	6779.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.995811751105318
Encrypted:	false
SSDEEP:	12:OxP9+PwveY+9+MufmxPVVIveY+VDuxP1e/qOveY+1e5exPcYGwoveY+cYyOOveYk:o87GYbqeYvqVvTlTm
MD5:	E1DFBA042BF63120A39D2D1E1033BBA6
SHA1:	E6C8F8C4938EA3644AB0D2405C4AB335CD001E2A
SHA-256:	A35907283EE39CAD1050A4B22B4DC559A92E12295CFC8C562EAEE84A4F3C23E0
SHA-512:	0EF51B41907C6ED9FE58C90EE8471D51CC2B084777E227A8D1B8FB74A8CE1E9CB299D670CA28051C9ECA1915B9E02995DD913A69E65E5F5B39D1C215C7C29ABC
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/6060..MIT-MAGIC-COOKIE-1..+p.f:.../P.#.....XSMP...#local/galassia:@/tmp/.ICE-unix/6060..MIT-MAGIC-COOKIE-1.....%..]....`.8<...ICE...!unix/galassia:/tmp/.ICE-unix/6007..MIT-MAGIC-COOKIE-1....P@....v.5......ICE...#local/galassia:@/tmp/.ICE-unix/6007..MIT-MAGIC-COOKIE-1.....Q..\.3.P....q..XSMP...!unix/galassia:/tmp/.ICE-unix/1498..MIT-MAGIC-COOKIE-1....d....2A..A p....XSMP...#local/galassia:@/tmp/.ICE-unix/1498..MIT-MAGIC-COOKIE-1...td.).-..7...C&..ICE...!unix/galassia:/tmp/.ICE-unix/1444..MIT-MAGIC-COOKIE-1.. ..a.<...k#8..U..ICE...#local/galassia:@/tmp/.ICE-unix/1444..MIT-MAGIC-COOKIE-1.....e....N`.R.H/..XSMP...#local/galassia:@/tmp/.ICE-unix/1444..MIT-MAGIC-COOKIE-1..0].".y..-=.#s....XSMP...!unix/galassia:/tmp/.ICE-unix/1444..MIT-MAGIC-COOKIE-1.._.,.m'.z.W..,.....ICE...#local/galassia:@/tmp/.ICE-unix/1498..MIT-MAGIC-COOKIE-1....s..<.....z...ICE...!unix/galassia:/tmp/.ICE-unix/1498..MIT-MAGIC-COOKIE-1.........@>.....9..XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.829448633352718
Encrypted:	false
SSDEEP:	3:rg/WFllasO93ww9bwgWFllasO93ww9v:rg/WFl2V9wgWFl2VV
MD5:	05D8D62D7BB692BCBEEFAB8C86AD7946
SHA1:	98086B76D1F9085AFDAEA211A465D59A55128E8B
SHA-256:	63960B687FCF3B5F2E7348401958E35BB3D2B34774E69D20A6E08ECBD7121014
SHA-512:	F7204DBDDCEE81B314D32BFA134B8E5DEC9DD1019C3002630A2249DBA315254C328DF1F4121943E676922C3DF5D541B768420FE88696B2B6DC40DC010528061A
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1..Tm%MU..l..].L..a....galassia....MIT-MAGIC-COOKIE-1..Tm%MU..l..].L..a

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:ao:ao
MD5:	1B27C696B13E0F1AFBEE8077ED7F32AB
SHA1:	25B913D6AF4D887655DD89A805F0A43C1CC3F4A7
SHA-256:	7E28659C877FC2611C434BF1E9BB0630468EC1C4A4765B39AED29C608A1F4A78
SHA-512:	85D97527A3B8BDA31CEA31317B4FFE44DE7BDA6F1050C39BAE603969AB18FB5F6C2F7FC4F8E016C6C75DC18C31B7981783F6ED6C71F467454D4EC85D69F782E8
Malicious:	false
Preview:	6343.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:MlR61sXlXEWtl/goFC19t:MLV+yl329t
MD5:	7DF8779B075C040BFF6E1E2B8EE6030F
SHA1:	6A0CB307DB551A2AF9BDD4A540B5F6E0C914009B
SHA-256:	8BA6BCA1564CBA8C4D7BAD44E220C22551254233DB86BA8C462F4865D3AED592
SHA-512:	457F2D5BE0AF467A323980F3FA45C31C112BB4D41AC78F449DBB26D2C4B79DD7D62758AE155D2279FE9E1C83C24850A5E4D4371BD6E535CED8244174680AF331
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................6lg.......................................

/tmp/qemu-open.xF2MeH (deleted)

Download File

Process:	/tmp/Aqua.arm5.elf
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.1162646156680225
Encrypted:	false
SSDEEP:	3:Tg0wV8HJN:TguJN
MD5:	4544A7679D740EEB693F73BE3B914EA6
SHA1:	D464EFA50C50C678F92B3527D32F733EE193E9FD
SHA-256:	BF8D67FE4A6830DF4F7C4EFDF835D627B7AC41C686A405ECBEBE1D58FE741A08
SHA-512:	828DBECBB143E5502FE6FE8B1CA67AFE4FAB9DFD02B0C9EEDFB648166A3F5CE4B2BC5927852CDC277B1D25B80431CCB2C637536B17D834AA3DA53B7926330024
Malicious:	false
Preview:	/tmp/Aqua.arm5.elf.nwlrbbmqbh

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.OGBWY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.UI8VY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.10766833629324
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWTwPxqP0E1H:q5sU3LWfLUDmQymqSFbfomSZwYP0Ef1
MD5:	19806D446D95AA2C5C22CDB63BE7C551
SHA1:	E4587777046A3E6C94A4CB16C9B6361BDE29CAA9
SHA-256:	329AA3071D1C61CC72ABFE7E4A48E6EBD5C0309BEF0717B1924E86407F80128F
SHA-512:	C51BF0C216CE1C238EE8A4E168E0A7EF2E51CB4C44222C74A0415F43C8AD03FE40C3C881DD5E5BA5F73D9B72480C3A50A85F3D78A1F23EEA8DBC8DFDF023C2CD
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-iEFo6nPy,guid=3ccaf65e4102b712e7b8dcf3676c36b6.IBUS_DAEMON_PID=6260.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.275935644421046
Encrypted:	false
SSDEEP:	384:WMqM5XuZaRdIMDdld0dPdZd2d/dudkdTdWdEdrdwd0dedEdod9dpdOdYOd5WdYSq:J/XIwJqSRgAlPE2fG3PtOv
MD5:	EF9DDBD4C1315E76CC088A3C6EB7BF62
SHA1:	5A4E2DF0608E6CC383DB43C4A513BD190EA5D67A
SHA-256:	FBB4DD9E7F354743B6278DC701DC605C5507F140358CC6BADA04527E4BAD9FE2
SHA-512:	89E191243D6D8FC1832A6EB0D5C3478FF286060C2F7B8C316CF4A424500331817ECE0FE0A2C6848574D08D6142DDCD92980165EDDFB4A36CB82908DDD7207E44
Malicious:	false
Preview:	[ 201.530] (--) Log file renamed from "/var/log/Xorg.pid-6042.log" to "/var/log/Xorg.0.log".[ 201.549] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 201.569] Build Operating System: linux Ubuntu.[ 201.576] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 201.582] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 201.597] Build Date: 06 July 2021 10:17:51AM.[ 201.603] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 201.610] Current version of pixman: 0.38.4.[ 201.616] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 201.621] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2133
Entropy (8bit):	5.002188154075262
Encrypted:	false
SSDEEP:	24:TgZeaXgZ4BX6GHknHAvwA2+V3S38FdjTKdcXju3NuerboQEgrCQcrCQU:Tub0gv1fVC3KvVFerbosrCBrCn
MD5:	A8493786D7CCC5BF5667E6F55798A568
SHA1:	2C479AC2FDC3B3FF18CE1245E3D539DB605FC158
SHA-256:	75266C97EE628225EB4D00727A9EE9E819C6C0B66FAFE287F8E0BD0A6392D3FF
SHA-512:	38A9C14A98D9191E4CC73A2A5E102F366948D9303034CEF4501268AC1DF3886013FC9F111103CE0C9D2E580CEEA913F37B0F5F8E6B591EB4A9778B55AE810583
Malicious:	false
Preview:	Dec 25 10:44:59 galassia systemd-logind[5918]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 25 10:44:59 galassia systemd-logind[5918]: Failed to add user by file name 127, ignoring: Invalid argument.Dec 25 10:44:59 galassia systemd-logind[5918]: User enumeration failed: Invalid argument.Dec 25 10:45:00 galassia systemd-logind[5918]: User of session 2 not known..Dec 25 10:45:00 galassia systemd-logind[5918]: Session enumeration failed: No such file or directory.Dec 25 10:45:00 galassia systemd-logind[5918]: Watching system buttons on /dev/input/event0 (Power Button).Dec 25 10:45:00 galassia systemd-logind[5918]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 25 10:45:00 galassia systemd-logind[5918]: New seat seat0..Dec 25 10:45:05 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 25 10:45:05 galassia systemd-logind[5918]: New session c1 of user gdm..Dec 25 10:45

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	40490
Entropy (8bit):	4.728576787827672
Encrypted:	false
SSDEEP:	384:8v29la9MYiwR/sLDUxZUkMbvpL4TQ/z7cn3D+mHmjM+sC09oUpit/uahbaNE472A:8v2/YLWkPbYgYHxQYK+g7KkjFtf
MD5:	F7CB786B18AFC87AE59B48C5418A4BFC
SHA1:	5C220B55CCE9613644910C7736ED343144F67763
SHA-256:	0A95506FAB6004A95341B5C9B272B04F01B298FD85D35D65877DE3987D3A9E77
SHA-512:	4DEC40B9AF868C193CC0134EC7FDA8FCC2706DFF397F8AD9F7B228BF8538E5016CEF7D1B7689A32BD6EE9CC5682FD6E792D5007BC4F793AD60E46DA36CC4E42A
Malicious:	false
Preview:	Dec 25 10:44:56 galassia kernel: [ 183.787930] blocking signal 9: 5552 -> 3220.Dec 25 10:44:56 galassia kernel: [ 184.255201] New task spawned: old: (tgid 5905, tid 5905), new (tgid: 5905, tid: 5907).Dec 25 10:44:56 galassia kernel: [ 184.255506] New task spawned: old: (tgid 5905, tid 5905), new (tgid: 5905, tid: 5908).Dec 25 10:44:57 galassia kernel: [ 184.256581] New task spawned: old: (tgid 5905, tid 5907), new (tgid: 5905, tid: 5909).Dec 25 10:44:59 galassia kernel: [ 185.374868] New task spawned: old: (tgid 5911, tid 5911), new (tgid: 5911, tid: 5913).Dec 25 10:44:59 galassia kernel: [ 186.600346] New task spawned: old: (tgid 5911, tid 5911), new (tgid: 5911, tid: 5915).Dec 25 10:44:59 galassia kernel: [ 186.977734] New task spawned: old: (tgid 5911, tid 5911), new (tgid: 5911, tid: 5977).Dec 25 10:44:59 galassia kernel: [ 187.534252] New task spawned: old: (tgid 5978, tid 5978), new (tgid: 5978, tid: 5979).Dec 25 10:45:00 galassia kernel: [ 187.574293] New task spawned:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	153909
Entropy (8bit):	5.21501632617756
Encrypted:	false
SSDEEP:	1536:k9O3XZoEPidp1R3ML7ya4PfIjJJ9fI973Af6uhdNNMASoJXOuXELK+g7vFAja3oT:kwnZ0urNqPYtm23o4fDk7
MD5:	CCE9D64646528517D51A818D576CC293
SHA1:	1CCD31BE223D8EE3E5A000B12856E15D63BE4497
SHA-256:	75B9AEFEC300F4921285F4AFE53AC1E0F28DEEC6E7F0D69FFF5D191A9319914B
SHA-512:	739B4DD384A22CB93FF83339F600402671A5CF8776CFCC2E6FC1DD172B6A4F60ED1272083EDBA01BB175443864D299BD518A70B2B6DF2563C8867F6DA0DBAC0E
Malicious:	false
Preview:	Dec 25 10:44:56 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 25 10:44:56 galassia kernel: [ 183.787930] blocking signal 9: 5552 -> 3220.Dec 25 10:44:56 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 25 10:44:56 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 3..Dec 25 10:44:56 galassia systemd[1]: Stopped System Logging Service..Dec 25 10:44:56 galassia systemd[1]: Starting System Logging Service....Dec 25 10:44:56 galassia systemd[1]: getty@tty2.service: Succeeded..Dec 25 10:44:56 galassia systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 2..Dec 25 10:44:56 galassia systemd[1]: Stopped Getty on tty2..Dec 25 10:44:56 galassia systemd[1]: Started Getty on tty2..Dec 25 10:44:56 galassia systemd[1]: Started System Logging Service..Dec 25 10:44:56 galassia kernel: [ 184.255201] New task spawned: old: (tgid 5905, tid 5905), new (tgid: 5905, tid: 5907).Dec 25 1

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:MlR61sXlXEWtl/goFC19t:MLV+yl329t
MD5:	7DF8779B075C040BFF6E1E2B8EE6030F
SHA1:	6A0CB307DB551A2AF9BDD4A540B5F6E0C914009B
SHA-256:	8BA6BCA1564CBA8C4D7BAD44E220C22551254233DB86BA8C462F4865D3AED592
SHA-512:	457F2D5BE0AF467A323980F3FA45C31C112BB4D41AC78F449DBB26D2C4B79DD7D62758AE155D2279FE9E1C83C24850A5E4D4371BD6E535CED8244174680AF331
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................6lg.......................................

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.051865866051839
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.arm5.elf
File size:	75'268 bytes
MD5:	02ef5e852076cf9c563fbaa180646c85
SHA1:	ec96ee7b457856f00fe02fe4c5579617f4adc054
SHA256:	3d7d516288e90fb68be50e151604f949215d982538d3d53cbfce723fe24a35f4
SHA512:	b6d7975aa4deb620c945e4355d82569fdf306a8779d62c7966c2f1ff55a849edb6d2f74e898789355f8dbec6cbea763a8528dc01e964813da262bf27e9161a7f
SSDEEP:	1536:EGcEk0+/kGoDbJKt34rbwlONi15znoedI6SiG:EGcSRI34vkRnVm
TLSH:	17733A91FD829613C6D012BBFB5E418D372A13A8D3EE72079E256F20378785B0E77652
File Content Preview:	.ELF...a..........(.........4...t$......4. ...(.......................................... ... ... ..4....&..........Q.td..................................-...L."...vA..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74868
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x10610	0x0	0x6	AX	16
.fini	PROGBITS	0x186c0	0x106c0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x186d4	0x106d4	0x1834	0x0	0x2	A	4
.ctors	PROGBITS	0x22000	0x12000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x22008	0x12008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x22014	0x12014	0x420	0x0	0x3	WA	4
.bss	NOBITS	0x22434	0x12434	0x21e0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x12434	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x11f08	0x11f08	6.0900	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x12000	0x22000	0x22000	0x434	0x2614	3.5150	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 17:44:41.212549925 CET	37424	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:41.332274914 CET	7733	37424	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:41.332349062 CET	37424	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:41.335043907 CET	37424	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:41.456324100 CET	7733	37424	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:42.136172056 CET	37428	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:42.256320000 CET	7733	37428	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:42.259963989 CET	37428	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:42.300731897 CET	37428	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:42.420594931 CET	7733	37428	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.241897106 CET	37430	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.364264011 CET	7733	37430	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.364356995 CET	37430	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.365686893 CET	37430	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.368020058 CET	37432	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.486529112 CET	7733	37430	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.488106966 CET	7733	37432	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.488270998 CET	37432	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.489675045 CET	37432	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.493343115 CET	37434	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.612588882 CET	7733	37432	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.615149975 CET	7733	37434	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.615230083 CET	37434	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.616395950 CET	37434	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.618098021 CET	37436	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.737095118 CET	7733	37434	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.738224983 CET	7733	37436	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.738322020 CET	37436	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.739556074 CET	37436	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.742141008 CET	37438	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.861685038 CET	7733	37436	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.864130020 CET	7733	37438	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:43.864209890 CET	37438	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.865293980 CET	37438	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.905538082 CET	37440	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:43.984874010 CET	7733	37438	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.027553082 CET	7733	37440	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.027631044 CET	37440	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.029391050 CET	37440	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.032675982 CET	37442	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.390927076 CET	7733	37440	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.390980005 CET	7733	37442	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.391052008 CET	37442	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.392231941 CET	37442	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.394968987 CET	37444	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.511822939 CET	7733	37442	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.514662981 CET	7733	37444	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.514719009 CET	37444	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.518403053 CET	37444	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.526124954 CET	37446	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.640006065 CET	7733	37444	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.647044897 CET	7733	37446	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.647131920 CET	37446	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.651176929 CET	37446	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.659558058 CET	37448	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.770977974 CET	7733	37446	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.779186010 CET	7733	37448	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.779934883 CET	37448	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.786756039 CET	37448	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.808237076 CET	37452	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.906394005 CET	7733	37448	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.928008080 CET	7733	37452	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:44.928097963 CET	37452	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.932529926 CET	37452	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:44.938834906 CET	37454	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.052119017 CET	7733	37452	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.058442116 CET	7733	37454	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.058500051 CET	37454	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.070930004 CET	37454	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.088026047 CET	37456	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.190519094 CET	7733	37454	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.207592964 CET	7733	37456	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.207660913 CET	37456	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.211868048 CET	37456	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.218472958 CET	37458	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.333142996 CET	7733	37456	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.337979078 CET	7733	37458	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.338035107 CET	37458	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.341065884 CET	37458	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.347429991 CET	37460	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.464741945 CET	7733	37458	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.467374086 CET	7733	37460	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.467453957 CET	37460	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.470727921 CET	37460	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.484904051 CET	37462	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.590471029 CET	7733	37460	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.604628086 CET	7733	37462	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.604717016 CET	37462	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.611021996 CET	37462	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.620481968 CET	37464	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.730645895 CET	7733	37462	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.740186930 CET	7733	37464	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.740242004 CET	37464	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.744992018 CET	37464	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.753922939 CET	37466	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.865884066 CET	7733	37464	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.873548031 CET	7733	37466	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:45.873650074 CET	37466	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.880110025 CET	37466	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.894288063 CET	37468	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:45.999756098 CET	7733	37466	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:46.013981104 CET	7733	37468	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:46.014066935 CET	37468	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:46.020433903 CET	37468	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:46.039128065 CET	37470	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:46.140048027 CET	7733	37468	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:46.158850908 CET	7733	37470	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:46.158950090 CET	37470	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:46.165219069 CET	37470	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:46.284887075 CET	7733	37470	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:49.398566961 CET	37474	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.518532991 CET	7733	37474	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:49.518601894 CET	37474	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.523188114 CET	37474	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.563611031 CET	37476	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.642779112 CET	7733	37474	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:49.683378935 CET	7733	37476	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:49.683473110 CET	37476	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.685251951 CET	37476	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.701606035 CET	37478	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.805104017 CET	7733	37476	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:49.821331978 CET	7733	37478	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:49.821463108 CET	37478	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.823774099 CET	37478	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.834683895 CET	37480	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.943794966 CET	7733	37478	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:49.954332113 CET	7733	37480	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:49.954420090 CET	37480	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.956664085 CET	37480	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:49.973180056 CET	37482	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.077022076 CET	7733	37480	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.093153000 CET	7733	37482	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.093241930 CET	37482	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.094778061 CET	37482	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.099020004 CET	37484	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.214555979 CET	7733	37482	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.218678951 CET	7733	37484	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.218852997 CET	37484	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.220344067 CET	37484	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.222261906 CET	37486	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.340044975 CET	7733	37484	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.342506886 CET	7733	37486	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.342597961 CET	37486	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.343878031 CET	37486	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.345479012 CET	37488	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.463545084 CET	7733	37486	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.465161085 CET	7733	37488	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.465280056 CET	37488	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.466666937 CET	37488	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.468352079 CET	37490	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.586261034 CET	7733	37488	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.587941885 CET	7733	37490	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.588026047 CET	37490	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.589325905 CET	37490	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.590822935 CET	37492	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.709050894 CET	7733	37490	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.710567951 CET	7733	37492	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.710697889 CET	37492	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.712025881 CET	37492	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.713754892 CET	37494	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.831651926 CET	7733	37492	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.833400965 CET	7733	37494	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.833486080 CET	37494	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.834721088 CET	37494	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.836805105 CET	37496	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.954215050 CET	7733	37494	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.956482887 CET	7733	37496	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:50.956538916 CET	37496	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.961565971 CET	37496	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:50.968746901 CET	37498	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.081167936 CET	7733	37496	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.088403940 CET	7733	37498	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.088485956 CET	37498	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.089421034 CET	37498	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.090871096 CET	37500	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.209069014 CET	7733	37498	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.210556030 CET	7733	37500	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.210613012 CET	37500	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.211491108 CET	37500	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.212764025 CET	37502	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.331938028 CET	7733	37500	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.333251953 CET	7733	37502	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.333307981 CET	37502	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.334348917 CET	37502	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.336476088 CET	37504	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.453896046 CET	7733	37502	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.456320047 CET	7733	37504	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.456399918 CET	37504	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.457293034 CET	37504	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.458532095 CET	37506	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.577352047 CET	7733	37504	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.578259945 CET	7733	37506	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.578334093 CET	37506	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.579394102 CET	37506	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.580576897 CET	37508	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.699101925 CET	7733	37506	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.700448990 CET	7733	37508	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.700579882 CET	37508	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.701817989 CET	37508	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.703361988 CET	37510	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.821424007 CET	7733	37508	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.822981119 CET	7733	37510	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.823074102 CET	37510	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.824038982 CET	37510	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.825472116 CET	37512	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.944920063 CET	7733	37510	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.946373940 CET	7733	37512	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:51.946480036 CET	37512	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.947640896 CET	37512	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:51.948940992 CET	37514	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.067255974 CET	7733	37512	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.068711996 CET	7733	37514	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.068809032 CET	37514	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.069844007 CET	37514	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.071743011 CET	37516	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.189527035 CET	7733	37514	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.191267014 CET	7733	37516	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.191359043 CET	37516	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.192375898 CET	37516	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.193780899 CET	37518	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.312361002 CET	7733	37516	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.313323021 CET	7733	37518	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.313401937 CET	37518	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.314244986 CET	37518	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.316972017 CET	37520	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.433790922 CET	7733	37518	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.436549902 CET	7733	37520	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.436655045 CET	37520	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.437649012 CET	37520	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.439104080 CET	37522	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.557565928 CET	7733	37520	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.559106112 CET	7733	37522	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.559184074 CET	37522	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.560128927 CET	37522	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.561536074 CET	37524	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.679717064 CET	7733	37522	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.681109905 CET	7733	37524	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.681236982 CET	37524	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.682509899 CET	37524	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.683990955 CET	37526	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.802171946 CET	7733	37524	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.804266930 CET	7733	37526	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.804421902 CET	37526	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.805545092 CET	37526	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.807033062 CET	37528	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.925571918 CET	7733	37526	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.926713943 CET	7733	37528	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:52.926877975 CET	37528	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.927933931 CET	37528	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:52.929388046 CET	37530	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.047657967 CET	7733	37528	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.048913956 CET	7733	37530	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.049043894 CET	37530	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.050050974 CET	37530	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.051795006 CET	37532	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.169734955 CET	7733	37530	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.171335936 CET	7733	37532	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.171426058 CET	37532	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.172255993 CET	37532	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.173470974 CET	37534	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.292570114 CET	7733	37532	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.293776035 CET	7733	37534	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.293888092 CET	37534	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.295031071 CET	37534	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.296288013 CET	37536	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.414940119 CET	7733	37534	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.415982008 CET	7733	37536	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.416057110 CET	37536	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.417023897 CET	37536	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.418240070 CET	37538	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.536509037 CET	7733	37536	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.538335085 CET	7733	37538	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.538444996 CET	37538	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.539335966 CET	37538	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.546968937 CET	37540	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.659302950 CET	7733	37538	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.666578054 CET	7733	37540	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.666665077 CET	37540	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.667525053 CET	37540	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.683614016 CET	37542	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.787652969 CET	7733	37540	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.803376913 CET	7733	37542	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.803524017 CET	37542	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.804423094 CET	37542	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.805753946 CET	37544	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.925618887 CET	7733	37542	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.927542925 CET	7733	37544	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:53.927649975 CET	37544	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.928600073 CET	37544	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:53.929953098 CET	37546	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.049139023 CET	7733	37544	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.050425053 CET	7733	37546	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.050518990 CET	37546	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.051476955 CET	37546	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.052777052 CET	37548	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.171006918 CET	7733	37546	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.173907042 CET	7733	37548	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.174031973 CET	37548	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.175132990 CET	37548	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.176489115 CET	37550	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.294795036 CET	7733	37548	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.296341896 CET	7733	37550	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.296432972 CET	37550	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.297317982 CET	37550	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.298655987 CET	37552	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.416826010 CET	7733	37550	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.418250084 CET	7733	37552	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.418349028 CET	37552	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.419284105 CET	37552	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.420536041 CET	37554	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.539458990 CET	7733	37552	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.540404081 CET	7733	37554	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.540488958 CET	37554	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.541445971 CET	37554	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.542792082 CET	37556	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.664731979 CET	7733	37554	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.665963888 CET	7733	37556	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.666076899 CET	37556	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.666935921 CET	37556	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.668107033 CET	37558	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.793684959 CET	7733	37556	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.794446945 CET	7733	37558	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.794502020 CET	37558	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.795278072 CET	37558	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.796673059 CET	37560	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.915981054 CET	7733	37558	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.917016983 CET	7733	37560	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:54.917099953 CET	37560	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.918006897 CET	37560	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:54.919188976 CET	37562	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.038100958 CET	7733	37560	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.039300919 CET	7733	37562	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.039464951 CET	37562	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.040333033 CET	37562	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.041416883 CET	37564	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.159956932 CET	7733	37562	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.161004066 CET	7733	37564	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.161112070 CET	37564	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.161979914 CET	37564	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.163491011 CET	37566	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.281522989 CET	7733	37564	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.283076048 CET	7733	37566	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.283293009 CET	37566	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.284168959 CET	37566	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.285326004 CET	37568	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.403697968 CET	7733	37566	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.405004025 CET	7733	37568	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.405062914 CET	37568	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.405766010 CET	37568	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.406862020 CET	37570	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.527019024 CET	7733	37568	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.527971983 CET	7733	37570	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.528117895 CET	37570	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.528971910 CET	37570	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.530164003 CET	37572	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.648996115 CET	7733	37570	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.649789095 CET	7733	37572	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.649868965 CET	37572	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.650598049 CET	37572	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.651770115 CET	37574	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.770153999 CET	7733	37572	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.771445990 CET	7733	37574	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.771506071 CET	37574	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.772258997 CET	37574	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.773406029 CET	37578	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.891921997 CET	7733	37574	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.892927885 CET	7733	37578	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:55.893066883 CET	37578	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.893877029 CET	37578	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:55.895090103 CET	37580	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.013465881 CET	7733	37578	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.014756918 CET	7733	37580	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.014851093 CET	37580	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.015645027 CET	37580	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.016767025 CET	37582	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.135165930 CET	7733	37580	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.136277914 CET	7733	37582	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.136411905 CET	37582	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.137325048 CET	37582	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.138459921 CET	37584	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.257064104 CET	7733	37582	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.258028984 CET	7733	37584	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.258112907 CET	37584	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.259147882 CET	37584	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.260303974 CET	37586	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.378715992 CET	7733	37584	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.379787922 CET	7733	37586	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.379978895 CET	37586	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.380810022 CET	37586	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.381973028 CET	37588	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.500521898 CET	7733	37586	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.501763105 CET	7733	37588	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.501895905 CET	37588	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.502736092 CET	37588	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.503897905 CET	37590	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.622277975 CET	7733	37588	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.623435020 CET	7733	37590	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.623655081 CET	37590	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.624474049 CET	37590	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.625675917 CET	37592	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.744230032 CET	7733	37590	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.745311022 CET	7733	37592	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.746272087 CET	37592	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.747165918 CET	37592	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.748337030 CET	37594	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.866914034 CET	7733	37592	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.867849112 CET	7733	37594	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.868069887 CET	37594	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.868933916 CET	37594	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.870136023 CET	37596	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.988527060 CET	7733	37594	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.989674091 CET	7733	37596	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:56.989753008 CET	37596	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.990665913 CET	37596	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:56.991802931 CET	37598	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.110284090 CET	7733	37596	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.111500978 CET	7733	37598	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.111746073 CET	37598	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.112567902 CET	37598	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.122315884 CET	37600	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.232100010 CET	7733	37598	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.241935968 CET	7733	37600	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.242146969 CET	37600	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.243014097 CET	37600	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.275307894 CET	37602	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.362555981 CET	7733	37600	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.395025969 CET	7733	37602	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.395440102 CET	37602	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.396401882 CET	37602	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.400726080 CET	37604	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.516227961 CET	7733	37602	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.520490885 CET	7733	37604	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.520553112 CET	37604	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.521603107 CET	37604	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.526051998 CET	37606	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.641134977 CET	7733	37604	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.645806074 CET	7733	37606	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:57.645895958 CET	37606	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.647068024 CET	37606	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:57.769085884 CET	7733	37606	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.038427114 CET	37424	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.160444021 CET	7733	37424	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.325886965 CET	37606	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325886965 CET	37604	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325907946 CET	37602	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325933933 CET	37598	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325933933 CET	37596	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325939894 CET	37600	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325959921 CET	37594	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325959921 CET	37592	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325999022 CET	37590	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.325999022 CET	37588	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326001883 CET	37582	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326001883 CET	37580	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326005936 CET	37578	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326008081 CET	37586	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326008081 CET	37584	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326015949 CET	37574	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326015949 CET	37572	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326020002 CET	37570	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326020002 CET	37568	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326046944 CET	37566	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326046944 CET	37564	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326052904 CET	37562	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326070070 CET	37560	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326073885 CET	37558	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326085091 CET	37556	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326111078 CET	37554	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326111078 CET	37552	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326121092 CET	37550	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326136112 CET	37548	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326148987 CET	37546	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326148987 CET	37544	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326164007 CET	37542	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326174974 CET	37540	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326184034 CET	37538	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326193094 CET	37536	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326201916 CET	37534	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326216936 CET	37532	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326225996 CET	37530	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326225996 CET	37528	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326248884 CET	37526	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326248884 CET	37524	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326268911 CET	37522	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326268911 CET	37520	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326313019 CET	37518	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326313019 CET	37516	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326313972 CET	37510	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326318026 CET	37512	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326318026 CET	37514	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326325893 CET	37508	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326342106 CET	37506	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326342106 CET	37504	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326359034 CET	37502	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326365948 CET	37500	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326394081 CET	37498	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326394081 CET	37496	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326410055 CET	37494	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326410055 CET	37492	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326425076 CET	37490	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326425076 CET	37488	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326443911 CET	37486	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326453924 CET	37484	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326464891 CET	37482	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326478958 CET	37480	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326489925 CET	37478	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326504946 CET	37476	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326513052 CET	37474	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326525927 CET	37470	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326525927 CET	37468	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326539040 CET	37466	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326549053 CET	37464	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326558113 CET	37462	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326569080 CET	37460	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326581001 CET	37458	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326592922 CET	37456	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326612949 CET	37454	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326612949 CET	37452	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326637983 CET	37448	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326654911 CET	37446	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326654911 CET	37444	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326668978 CET	37442	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326689005 CET	37440	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326694012 CET	37438	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326708078 CET	37436	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326714993 CET	37434	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326725006 CET	37432	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326776028 CET	37430	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326776028 CET	37428	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.326793909 CET	37424	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:44:58.487236023 CET	7733	37520	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487248898 CET	7733	37522	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487266064 CET	7733	37524	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487277985 CET	7733	37526	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487287998 CET	7733	37528	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487307072 CET	7733	37530	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487323046 CET	7733	37532	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487333059 CET	7733	37534	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487339020 CET	7733	37536	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487349033 CET	7733	37538	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487386942 CET	7733	37540	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487396955 CET	7733	37542	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487406969 CET	7733	37544	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487420082 CET	7733	37546	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487431049 CET	7733	37548	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487441063 CET	7733	37552	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487449884 CET	7733	37550	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487459898 CET	7733	37554	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487469912 CET	7733	37556	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487479925 CET	7733	37558	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487497091 CET	7733	37560	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487507105 CET	7733	37562	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487517118 CET	7733	37564	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487526894 CET	7733	37566	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487538099 CET	7733	37568	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487555027 CET	7733	37570	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487565041 CET	7733	37572	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487581015 CET	7733	37574	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487591028 CET	7733	37580	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487601042 CET	7733	37582	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487611055 CET	7733	37578	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487621069 CET	7733	37584	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487631083 CET	7733	37586	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487642050 CET	7733	37588	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487653017 CET	7733	37590	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487663031 CET	7733	37592	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487672091 CET	7733	37594	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487682104 CET	7733	37596	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487692118 CET	7733	37598	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487700939 CET	7733	37600	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487710953 CET	7733	37604	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487720013 CET	7733	37602	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.487730980 CET	7733	37606	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495064020 CET	7733	37440	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495073080 CET	7733	37442	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495089054 CET	7733	37444	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495098114 CET	7733	37446	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495105982 CET	7733	37448	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495145082 CET	7733	37452	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495153904 CET	7733	37454	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495187998 CET	7733	37456	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495210886 CET	7733	37458	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495229006 CET	7733	37460	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495253086 CET	7733	37462	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495301008 CET	7733	37464	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495338917 CET	7733	37466	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495349884 CET	7733	37468	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495372057 CET	7733	37470	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495399952 CET	7733	37474	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495409012 CET	7733	37476	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495580912 CET	7733	37478	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495589972 CET	7733	37480	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495596886 CET	7733	37482	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495606899 CET	7733	37484	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495616913 CET	7733	37486	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495624065 CET	7733	37488	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495632887 CET	7733	37490	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495641947 CET	7733	37492	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495651007 CET	7733	37494	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495657921 CET	7733	37496	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495666027 CET	7733	37498	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495675087 CET	7733	37500	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495682955 CET	7733	37502	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495693922 CET	7733	37504	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495702982 CET	7733	37506	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495709896 CET	7733	37516	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495718956 CET	7733	37508	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495727062 CET	7733	37514	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495734930 CET	7733	37512	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495743990 CET	7733	37510	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.495750904 CET	7733	37518	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.606901884 CET	7733	37424	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.606920004 CET	7733	37428	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.606982946 CET	7733	37430	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.606992960 CET	7733	37432	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.607007027 CET	7733	37434	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.607016087 CET	7733	37436	89.190.156.145	192.168.2.15
Dec 25, 2024 17:44:58.607105970 CET	7733	37438	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:03.234853029 CET	7733	37424	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:03.234913111 CET	37424	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:04.172535896 CET	7733	37428	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:04.172655106 CET	37428	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:05.266427040 CET	7733	37430	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:05.266482115 CET	37430	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:05.422421932 CET	7733	37432	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:05.422513962 CET	37432	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:05.563205957 CET	7733	37434	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:05.563339949 CET	37434	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:05.657658100 CET	7733	37436	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:05.657708883 CET	37436	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:05.766405106 CET	7733	37438	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:05.766474009 CET	37438	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:06.172452927 CET	7733	37440	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:06.172511101 CET	37440	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:06.297982931 CET	7733	37442	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:06.298062086 CET	37442	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:06.391690016 CET	7733	37444	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:06.391773939 CET	37444	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:06.548629045 CET	7733	37446	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:06.548763037 CET	37446	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:06.672607899 CET	7733	37448	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:06.672662020 CET	37448	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:06.813195944 CET	7733	37452	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:06.813283920 CET	37452	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:06.969475985 CET	7733	37454	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:06.969537973 CET	37454	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:07.125874043 CET	7733	37456	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:07.125941038 CET	37456	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:07.251837015 CET	7733	37458	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:07.251900911 CET	37458	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:07.391330957 CET	7733	37460	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:07.391395092 CET	37460	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:07.550775051 CET	7733	37462	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:07.550843000 CET	37462	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:07.656902075 CET	7733	37464	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:07.656970024 CET	37464	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:07.766084909 CET	7733	37466	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:07.766144037 CET	37466	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:07.891273975 CET	7733	37468	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:07.891333103 CET	37468	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:08.078756094 CET	7733	37470	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:08.078824043 CET	37470	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:11.422460079 CET	7733	37474	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:11.422530890 CET	37474	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:11.563249111 CET	7733	37476	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:11.563338995 CET	37476	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:11.734941006 CET	7733	37478	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:11.735043049 CET	37478	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:11.891772985 CET	7733	37480	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:11.891841888 CET	37480	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.000766993 CET	7733	37482	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.000839949 CET	37482	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.094454050 CET	7733	37484	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.094624043 CET	37484	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.268739939 CET	7733	37486	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.268910885 CET	37486	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.375708103 CET	7733	37488	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.375895023 CET	37488	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.502088070 CET	7733	37490	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.502161026 CET	37490	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.627368927 CET	7733	37492	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.627473116 CET	37492	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.766607046 CET	7733	37494	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.766710997 CET	37494	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.875854015 CET	7733	37496	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.875931978 CET	37496	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:12.969650984 CET	7733	37498	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:12.969752073 CET	37498	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:13.172653913 CET	7733	37500	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:13.172729015 CET	37500	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:13.219537973 CET	7733	37502	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:13.219620943 CET	37502	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:13.391392946 CET	7733	37504	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:13.391489029 CET	37504	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:13.547719002 CET	7733	37506	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:13.547796011 CET	37506	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:13.594645023 CET	7733	37508	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:13.594722986 CET	37508	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:13.735555887 CET	7733	37510	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:13.735621929 CET	37510	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:13.844551086 CET	7733	37512	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:13.844615936 CET	37512	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:13.969589949 CET	7733	37514	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:13.969649076 CET	37514	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:14.094880104 CET	7733	37516	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:14.094958067 CET	37516	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:14.204749107 CET	7733	37518	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:14.204812050 CET	37518	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:14.344347000 CET	7733	37520	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:14.344410896 CET	37520	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:14.469727993 CET	7733	37522	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:14.469784021 CET	37522	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:14.579251051 CET	7733	37524	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:14.579304934 CET	37524	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:14.688605070 CET	7733	37526	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:14.688657999 CET	37526	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:14.844423056 CET	7733	37528	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:14.844472885 CET	37528	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:14.938473940 CET	7733	37530	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:14.938524961 CET	37530	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:15.063250065 CET	7733	37532	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:15.063328981 CET	37532	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:15.188146114 CET	7733	37534	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:15.188220978 CET	37534	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:15.328865051 CET	7733	37536	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:15.328929901 CET	37536	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:15.438299894 CET	7733	37538	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:15.438369036 CET	37538	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:15.594491005 CET	7733	37540	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:15.594562054 CET	37540	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:15.735006094 CET	7733	37542	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:15.735127926 CET	37542	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:15.813369989 CET	7733	37544	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:15.813429117 CET	37544	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:15.969939947 CET	7733	37546	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:15.970097065 CET	37546	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.063493013 CET	7733	37548	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.063553095 CET	37548	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.204056025 CET	7733	37550	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.204114914 CET	37550	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.314400911 CET	7733	37552	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.314455032 CET	37552	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.805231094 CET	7733	37554	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.805243969 CET	7733	37556	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.805265903 CET	7733	37558	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.805308104 CET	37554	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.805315018 CET	37556	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.805315018 CET	37558	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.805448055 CET	7733	37552	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.805540085 CET	37552	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.844453096 CET	7733	37560	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.844521999 CET	37560	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.866900921 CET	7733	37554	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.866951942 CET	37554	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.926852942 CET	7733	37552	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.969609976 CET	7733	37562	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:16.969677925 CET	37562	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:16.987833023 CET	7733	37554	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.063267946 CET	7733	37564	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.063332081 CET	37564	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:17.172686100 CET	7733	37566	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.172794104 CET	37566	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:17.315912008 CET	7733	37568	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.315954924 CET	37568	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:17.422662973 CET	7733	37570	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.422748089 CET	37570	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:17.594547987 CET	7733	37572	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.594681978 CET	37572	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:17.672566891 CET	7733	37574	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.672625065 CET	37574	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:17.797858000 CET	7733	37578	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.797913074 CET	37578	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:17.922849894 CET	7733	37580	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:17.922899961 CET	37580	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:18.047862053 CET	7733	37582	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:18.047909975 CET	37582	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:18.173207998 CET	7733	37584	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:18.173284054 CET	37584	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:18.297637939 CET	7733	37586	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:18.297683954 CET	37586	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:18.407089949 CET	7733	37588	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:18.407187939 CET	37588	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:18.517045021 CET	7733	37590	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:18.517093897 CET	37590	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:18.641596079 CET	7733	37592	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:18.641642094 CET	37592	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:18.766489983 CET	7733	37594	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:18.766575098 CET	37594	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:18.891369104 CET	7733	37596	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:18.891433001 CET	37596	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:19.016805887 CET	7733	37598	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:19.016860008 CET	37598	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:19.157282114 CET	7733	37600	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:19.157387972 CET	37600	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:19.375638962 CET	7733	37602	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:19.375686884 CET	37602	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:19.485287905 CET	7733	37604	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:19.485354900 CET	37604	7733	192.168.2.15	89.190.156.145
Dec 25, 2024 17:45:19.578896046 CET	7733	37606	89.190.156.145	192.168.2.15
Dec 25, 2024 17:45:19.578944921 CET	37606	7733	192.168.2.15	89.190.156.145

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 17:44:40.667483091 CET	58300	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:40.801621914 CET	53	58300	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:40.803567886 CET	50474	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:40.937619925 CET	53	50474	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:40.938647032 CET	56058	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:41.077902079 CET	53	56058	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:41.079282999 CET	46813	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:41.214052916 CET	53	46813	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:41.215172052 CET	37835	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:41.354455948 CET	53	37835	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:41.357769012 CET	59454	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:41.491653919 CET	53	59454	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:41.494004965 CET	41377	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:41.628474951 CET	53	41377	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:41.631675959 CET	42225	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:41.766041040 CET	53	42225	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:41.778250933 CET	50927	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:41.912895918 CET	53	50927	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:41.915278912 CET	58932	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:42.049813986 CET	53	58932	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:45.069917917 CET	49739	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:45.203741074 CET	53	49739	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:45.206362009 CET	40792	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:45.330605984 CET	53	40792	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:45.333161116 CET	46411	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:45.463128090 CET	53	46411	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:45.465883970 CET	47457	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:45.590231895 CET	53	47457	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:45.594532967 CET	56310	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:45.717905045 CET	53	56310	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:45.722796917 CET	54455	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:45.865978003 CET	53	54455	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:45.875760078 CET	40380	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:46.009902954 CET	53	40380	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:46.014703989 CET	34202	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:46.149147987 CET	53	34202	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:46.154222012 CET	53526	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:46.293430090 CET	53	53526	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:46.298470974 CET	39355	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:46.432718039 CET	53	39355	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:54.443984985 CET	47119	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:54.570730925 CET	53	47119	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:54.571775913 CET	54898	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:54.698534012 CET	53	54898	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:54.699392080 CET	52862	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:54.825834990 CET	53	52862	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:54.826533079 CET	49832	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:54.949981928 CET	53	49832	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:54.950988054 CET	35478	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:55.073606968 CET	53	35478	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:55.074425936 CET	35448	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:55.208987951 CET	53	35448	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:55.209808111 CET	53387	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:55.350749969 CET	53	53387	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:55.351562023 CET	45692	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:55.488162994 CET	53	45692	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:55.489104986 CET	58578	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:55.624218941 CET	53	58578	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:55.625189066 CET	59113	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:55.759875059 CET	53	59113	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:56.762433052 CET	56363	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:56.885113001 CET	53	56363	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:56.885912895 CET	38064	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:57.013863087 CET	53	38064	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:57.014770031 CET	39454	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:57.137223005 CET	53	39454	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:57.138159990 CET	56377	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:57.266042948 CET	53	56377	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:57.267324924 CET	38362	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:57.400774002 CET	53	38362	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:57.402287960 CET	55954	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:57.544188023 CET	53	55954	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:57.545505047 CET	37272	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:57.679970980 CET	53	37272	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:57.681396961 CET	58413	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:57.817815065 CET	53	58413	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:57.819518089 CET	44734	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:57.953739882 CET	53	44734	8.8.8.8	192.168.2.15
Dec 25, 2024 17:44:57.955280066 CET	42362	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:44:58.099776983 CET	53	42362	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:00.736768961 CET	48786	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:00.736819983 CET	40619	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:00.859385967 CET	53	40619	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:00.870562077 CET	53	48786	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:08.121970892 CET	35435	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:08.244680882 CET	53	35435	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:08.247059107 CET	42781	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:08.381302118 CET	53	42781	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:08.382921934 CET	36250	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:08.506021023 CET	53	36250	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:08.507838964 CET	39211	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:08.631114006 CET	53	39211	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:08.635948896 CET	37353	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:08.766951084 CET	53	37353	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:08.769316912 CET	36323	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:08.904520035 CET	53	36323	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:08.907533884 CET	55242	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:09.049288034 CET	53	55242	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:09.054126978 CET	35289	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:09.194690943 CET	53	35289	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:09.197473049 CET	39744	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:09.339131117 CET	53	39744	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:09.341613054 CET	44797	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:09.475393057 CET	53	44797	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:13.483203888 CET	58460	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:13.611025095 CET	53	58460	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:13.612773895 CET	36947	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:13.738221884 CET	53	36947	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:13.739958048 CET	60169	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:13.865607977 CET	53	60169	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:13.867319107 CET	38183	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:13.995160103 CET	53	38183	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:13.997312069 CET	54328	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:14.123087883 CET	53	54328	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:14.125377893 CET	43835	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:14.259254932 CET	53	43835	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:14.262794018 CET	50597	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:14.397475004 CET	53	50597	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:14.403723001 CET	35489	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:14.546032906 CET	53	35489	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:14.549686909 CET	57810	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:14.690362930 CET	53	57810	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:14.693269968 CET	35763	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:14.827131033 CET	53	35763	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:21.831053972 CET	43423	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:21.953421116 CET	53	43423	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:21.954833984 CET	56817	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:22.077351093 CET	53	56817	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:22.078963041 CET	39363	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:22.202821970 CET	53	39363	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:22.204791069 CET	56759	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:22.327601910 CET	53	56759	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:22.329297066 CET	53432	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:22.451617002 CET	53	53432	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:22.452975988 CET	43116	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:22.592540026 CET	53	43116	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:22.594141960 CET	38801	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:22.728334904 CET	53	38801	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:22.730293036 CET	44001	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:22.864279985 CET	53	44001	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:22.866194010 CET	32929	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:23.000251055 CET	53	32929	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:23.001719952 CET	55834	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:23.136190891 CET	53	55834	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:24.140580893 CET	46202	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:24.263199091 CET	53	46202	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:24.264863014 CET	34006	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:24.387335062 CET	53	34006	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:24.388781071 CET	39291	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:24.514286995 CET	53	39291	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:24.515877962 CET	58197	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:24.638418913 CET	53	58197	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:24.642252922 CET	52398	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:24.767759085 CET	53	52398	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:24.771261930 CET	60613	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:24.910526037 CET	53	60613	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:24.912086964 CET	40015	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:25.047127962 CET	53	40015	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:25.049016953 CET	48583	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:25.182729006 CET	53	48583	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:25.184362888 CET	46142	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:25.318330050 CET	53	46142	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:25.320768118 CET	53113	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:25.454473019 CET	53	53113	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:32.458642006 CET	56275	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:32.580957890 CET	53	56275	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:32.582607031 CET	33496	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:32.716290951 CET	53	33496	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:32.717736006 CET	53324	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:32.852183104 CET	53	53324	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:32.853744030 CET	60682	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:32.976183891 CET	53	60682	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:32.979201078 CET	50872	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:33.102075100 CET	53	50872	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:33.107135057 CET	52789	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:33.242278099 CET	53	52789	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:33.245450974 CET	55898	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:33.379766941 CET	53	55898	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:33.382914066 CET	45430	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:33.518348932 CET	53	45430	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:33.520322084 CET	32909	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:33.654042959 CET	53	32909	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:33.656048059 CET	33498	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:33.798115969 CET	53	33498	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:36.803900957 CET	44863	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:36.926822901 CET	53	44863	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:36.928427935 CET	45427	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:37.496922016 CET	53	45427	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:37.498598099 CET	32953	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:37.626360893 CET	53	32953	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:37.631335020 CET	42673	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:37.753884077 CET	53	42673	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:37.756021023 CET	42560	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:37.889849901 CET	53	42560	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:37.892323017 CET	42158	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:38.027614117 CET	53	42158	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:38.029088974 CET	49329	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:38.162887096 CET	53	49329	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:38.164225101 CET	35863	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:38.297923088 CET	53	35863	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:38.299276114 CET	51036	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:38.433223009 CET	53	51036	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:38.434704065 CET	51130	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:38.568315029 CET	53	51130	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:45.577362061 CET	48288	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:45.704396963 CET	53	48288	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:45.712032080 CET	49244	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:45.835856915 CET	53	49244	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:45.845211983 CET	43209	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:45.968094110 CET	53	43209	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:46.000895023 CET	46790	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:46.136843920 CET	53	46790	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:46.149338007 CET	54666	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:46.283519030 CET	53	54666	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:46.293236017 CET	35007	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:46.427004099 CET	53	35007	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:46.433324099 CET	37038	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:46.567490101 CET	53	37038	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:46.575198889 CET	49716	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:46.709708929 CET	53	49716	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:46.715332985 CET	45924	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:46.850212097 CET	53	45924	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:46.854027987 CET	48239	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:46.987719059 CET	53	48239	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:49.002605915 CET	41085	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:49.125087976 CET	53	41085	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:49.130692959 CET	55828	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:49.255846977 CET	53	55828	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:49.263438940 CET	47960	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:49.397083044 CET	53	47960	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:49.404798031 CET	37608	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:49.538544893 CET	53	37608	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:49.542865992 CET	58201	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:49.665282011 CET	53	58201	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:49.674932003 CET	53917	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:49.810297966 CET	53	53917	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:49.816450119 CET	58339	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:49.950952053 CET	53	58339	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:49.956183910 CET	46069	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:50.098119020 CET	53	46069	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:50.108350039 CET	34357	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:50.242516041 CET	53	34357	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:50.249175072 CET	49291	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:50.382977009 CET	53	49291	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:59.429143906 CET	52507	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:59.554428101 CET	53	52507	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:59.578474998 CET	37256	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:59.706335068 CET	53	37256	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:59.731573105 CET	32905	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:45:59.853852034 CET	53	32905	8.8.8.8	192.168.2.15
Dec 25, 2024 17:45:59.875585079 CET	48454	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:00.003515005 CET	53	48454	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:00.029319048 CET	49008	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:00.156927109 CET	53	49008	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:00.181268930 CET	53745	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:00.322940111 CET	53	53745	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:00.346143961 CET	40587	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:00.481836081 CET	53	40587	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:00.507872105 CET	58366	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:00.642214060 CET	53	58366	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:00.786067963 CET	44450	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:00.920188904 CET	53	44450	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:00.946126938 CET	48202	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:01.080643892 CET	53	48202	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:09.177079916 CET	54392	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:09.310995102 CET	53	54392	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:09.324697971 CET	38238	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:09.459283113 CET	53	38238	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:09.485294104 CET	56616	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:09.619437933 CET	53	56616	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:09.644403934 CET	37497	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:09.766839981 CET	53	37497	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:09.783195019 CET	53571	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:09.917690992 CET	53	53571	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:09.929582119 CET	52266	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:10.069658995 CET	53	52266	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:10.079857111 CET	39618	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:10.214850903 CET	53	39618	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:10.236474991 CET	58425	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:10.378241062 CET	53	58425	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:10.402389050 CET	46501	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:10.536547899 CET	53	46501	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:10.563417912 CET	33268	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:10.697680950 CET	53	33268	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:20.763838053 CET	52619	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:20.886473894 CET	53	52619	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:20.904117107 CET	39291	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:21.033473015 CET	53	39291	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:21.044037104 CET	44512	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:21.171912909 CET	53	44512	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:21.184700966 CET	47668	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:21.312747002 CET	53	47668	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:21.328510046 CET	53073	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:21.450925112 CET	53	53073	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:21.473689079 CET	32865	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:21.608086109 CET	53	32865	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:21.616451979 CET	57810	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:21.758263111 CET	53	57810	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:21.768434048 CET	45662	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:21.913230896 CET	53	45662	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:21.927370071 CET	40592	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:22.073220015 CET	53	40592	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:22.085666895 CET	60494	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:22.219681025 CET	53	60494	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:25.301786900 CET	48829	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:25.424324036 CET	53	48829	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:25.437474966 CET	60797	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:25.560960054 CET	53	60797	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:25.577552080 CET	37181	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:25.703682899 CET	53	37181	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:25.722975016 CET	40271	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:25.845407009 CET	53	40271	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:25.854767084 CET	54816	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:25.977406025 CET	53	54816	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:25.988140106 CET	33064	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:26.122206926 CET	53	33064	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:26.133985043 CET	58896	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:26.267950058 CET	53	58896	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:26.275594950 CET	46032	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:26.409328938 CET	53	46032	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:26.419864893 CET	47488	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:26.553519011 CET	53	47488	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:26.561276913 CET	33766	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:26.695379019 CET	53	33766	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:27.719295979 CET	47264	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:27.852895021 CET	53	47264	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:27.857577085 CET	55704	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:27.983032942 CET	53	55704	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:27.987164021 CET	38794	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:28.109965086 CET	53	38794	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:28.115978956 CET	47642	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:28.249526978 CET	53	47642	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:28.254952908 CET	57491	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:28.379040003 CET	53	57491	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:28.383943081 CET	34532	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:28.518260002 CET	53	34532	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:28.521524906 CET	55272	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:28.655375957 CET	53	55272	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:28.659746885 CET	41591	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:28.794919014 CET	53	41591	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:28.798865080 CET	56160	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:28.941338062 CET	53	56160	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:28.947571039 CET	58102	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:29.082847118 CET	53	58102	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:32.094150066 CET	40295	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:32.219409943 CET	53	40295	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:32.222702026 CET	59777	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:32.345087051 CET	53	59777	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:32.349581957 CET	42442	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:32.478878975 CET	53	42442	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:32.481734037 CET	58659	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:32.605128050 CET	53	58659	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:32.608753920 CET	44026	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:32.734092951 CET	53	44026	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:32.746696949 CET	56372	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:32.888550997 CET	53	56372	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:32.891791105 CET	39041	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:33.026360989 CET	53	39041	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:33.029603004 CET	49796	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:33.163651943 CET	53	49796	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:33.166587114 CET	56506	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:33.300748110 CET	53	56506	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:33.303541899 CET	36779	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:33.437351942 CET	53	36779	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:37.442579985 CET	47497	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:37.565001011 CET	53	47497	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:37.566489935 CET	59898	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:37.692269087 CET	53	59898	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:37.693886042 CET	42235	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:37.816286087 CET	53	42235	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:37.817934990 CET	36877	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:37.941163063 CET	53	36877	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:37.942749977 CET	42981	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:38.065390110 CET	53	42981	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:38.066572905 CET	49126	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:38.201179028 CET	53	49126	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:38.202430964 CET	55252	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:38.336884975 CET	53	55252	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:38.338314056 CET	34760	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:38.473007917 CET	53	34760	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:38.474288940 CET	46008	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:38.617022991 CET	53	46008	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:38.618175030 CET	43454	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:38.753554106 CET	53	43454	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:46.757682085 CET	34915	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:46.880228996 CET	53	34915	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:46.881711960 CET	47377	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:47.016552925 CET	53	47377	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:47.017805099 CET	40455	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:47.141058922 CET	53	40455	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:47.142750025 CET	47172	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:47.265436888 CET	53	47172	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:47.266798973 CET	38480	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:47.389812946 CET	53	38480	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:47.391022921 CET	44453	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:47.533035040 CET	53	44453	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:47.534194946 CET	58922	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:47.680902958 CET	53	58922	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:47.682183981 CET	45168	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:47.816936016 CET	53	45168	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:47.818018913 CET	39782	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:47.960289001 CET	53	39782	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:47.961368084 CET	56043	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:48.095877886 CET	53	56043	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:54.099298954 CET	60742	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:54.221966982 CET	53	60742	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:54.223229885 CET	57894	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:54.357553005 CET	53	57894	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:54.358917952 CET	40991	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:54.481621027 CET	53	40991	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:54.482852936 CET	47875	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:54.611258030 CET	53	47875	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:54.612355947 CET	46215	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:54.734819889 CET	53	46215	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:54.736114025 CET	52071	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:54.870630026 CET	53	52071	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:54.871943951 CET	36755	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:55.006110907 CET	53	36755	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:55.007189989 CET	39959	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:55.141233921 CET	53	39959	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:55.142151117 CET	40956	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:55.284090042 CET	53	40956	8.8.8.8	192.168.2.15
Dec 25, 2024 17:46:55.285273075 CET	47704	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:46:55.428440094 CET	53	47704	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:05.432010889 CET	45225	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:05.554686069 CET	53	45225	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:05.556123972 CET	42863	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:05.678944111 CET	53	42863	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:05.680246115 CET	37977	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:05.813796043 CET	53	37977	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:05.815140009 CET	38259	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:05.938051939 CET	53	38259	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:05.939245939 CET	59715	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:06.061918020 CET	53	59715	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:06.063323021 CET	51716	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:06.203219891 CET	53	51716	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:06.204824924 CET	60171	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:06.338260889 CET	53	60171	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:06.339684010 CET	50252	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:06.480438948 CET	53	50252	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:06.481945038 CET	56202	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:06.621290922 CET	53	56202	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:06.622585058 CET	50474	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:06.756917000 CET	53	50474	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:09.761358976 CET	59542	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:09.891742945 CET	53	59542	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:09.893652916 CET	40849	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:10.021476984 CET	53	40849	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:10.023225069 CET	45427	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:10.156862974 CET	53	45427	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:10.158319950 CET	48703	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:10.280991077 CET	53	48703	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:10.282253027 CET	42570	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:10.411355019 CET	53	42570	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:10.412863016 CET	48833	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:10.548888922 CET	53	48833	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:10.550793886 CET	37570	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:10.684923887 CET	53	37570	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:10.686767101 CET	60758	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:10.823024988 CET	53	60758	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:10.824985981 CET	58962	53	192.168.2.15	8.8.8.8
Dec 25, 2024 17:47:10.966387033 CET	53	58962	8.8.8.8	192.168.2.15
Dec 25, 2024 17:47:10.968580961 CET	52738	53	192.168.2.15	8.8.8.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 25, 2024 17:44:50.077290058 CET	192.168.2.15	192.168.2.1	827b	(Port unreachable)	Destination Unreachable
Dec 25, 2024 17:46:10.089732885 CET	192.168.2.15	192.168.2.1	827b	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 17:44:40.667483091 CET	192.168.2.15	8.8.8.8	0x226	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:40.803567886 CET	192.168.2.15	8.8.8.8	0x226	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:40.938647032 CET	192.168.2.15	8.8.8.8	0x226	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.079282999 CET	192.168.2.15	8.8.8.8	0x226	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.215172052 CET	192.168.2.15	8.8.8.8	0x226	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.357769012 CET	192.168.2.15	8.8.8.8	0x609f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.494004965 CET	192.168.2.15	8.8.8.8	0x609f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.631675959 CET	192.168.2.15	8.8.8.8	0x609f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.778250933 CET	192.168.2.15	8.8.8.8	0x609f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.915278912 CET	192.168.2.15	8.8.8.8	0x609f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:45.722796917 CET	192.168.2.15	8.8.8.8	0x9526	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:45.875760078 CET	192.168.2.15	8.8.8.8	0x9526	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:46.014703989 CET	192.168.2.15	8.8.8.8	0x9526	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:46.154222012 CET	192.168.2.15	8.8.8.8	0x9526	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:46.298470974 CET	192.168.2.15	8.8.8.8	0x9526	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.074425936 CET	192.168.2.15	8.8.8.8	0xf51d	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.209808111 CET	192.168.2.15	8.8.8.8	0xf51d	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.351562023 CET	192.168.2.15	8.8.8.8	0xf51d	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.489104986 CET	192.168.2.15	8.8.8.8	0xf51d	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.625189066 CET	192.168.2.15	8.8.8.8	0xf51d	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.402287960 CET	192.168.2.15	8.8.8.8	0xa5c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.545505047 CET	192.168.2.15	8.8.8.8	0xa5c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.681396961 CET	192.168.2.15	8.8.8.8	0xa5c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.819518089 CET	192.168.2.15	8.8.8.8	0xa5c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.955280066 CET	192.168.2.15	8.8.8.8	0xa5c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:00.736768961 CET	192.168.2.15	8.8.8.8	0xf057	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:00.736819983 CET	192.168.2.15	8.8.8.8	0x82fe	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 25, 2024 17:45:08.769316912 CET	192.168.2.15	8.8.8.8	0x9517	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:08.907533884 CET	192.168.2.15	8.8.8.8	0x9517	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:09.054126978 CET	192.168.2.15	8.8.8.8	0x9517	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:09.197473049 CET	192.168.2.15	8.8.8.8	0x9517	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:09.341613054 CET	192.168.2.15	8.8.8.8	0x9517	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.125377893 CET	192.168.2.15	8.8.8.8	0x411c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.262794018 CET	192.168.2.15	8.8.8.8	0x411c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.403723001 CET	192.168.2.15	8.8.8.8	0x411c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.549686909 CET	192.168.2.15	8.8.8.8	0x411c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.693269968 CET	192.168.2.15	8.8.8.8	0x411c	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:22.452975988 CET	192.168.2.15	8.8.8.8	0x1c2	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:22.594141960 CET	192.168.2.15	8.8.8.8	0x1c2	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:22.730293036 CET	192.168.2.15	8.8.8.8	0x1c2	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:22.866194010 CET	192.168.2.15	8.8.8.8	0x1c2	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:23.001719952 CET	192.168.2.15	8.8.8.8	0x1c2	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:24.771261930 CET	192.168.2.15	8.8.8.8	0xc3f0	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:24.912086964 CET	192.168.2.15	8.8.8.8	0xc3f0	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:25.049016953 CET	192.168.2.15	8.8.8.8	0xc3f0	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:25.184362888 CET	192.168.2.15	8.8.8.8	0xc3f0	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:25.320768118 CET	192.168.2.15	8.8.8.8	0xc3f0	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.107135057 CET	192.168.2.15	8.8.8.8	0x4d7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.245450974 CET	192.168.2.15	8.8.8.8	0x4d7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.382914066 CET	192.168.2.15	8.8.8.8	0x4d7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.520322084 CET	192.168.2.15	8.8.8.8	0x4d7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.656048059 CET	192.168.2.15	8.8.8.8	0x4d7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:37.892323017 CET	192.168.2.15	8.8.8.8	0x4889	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.029088974 CET	192.168.2.15	8.8.8.8	0x4889	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.164225101 CET	192.168.2.15	8.8.8.8	0x4889	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.299276114 CET	192.168.2.15	8.8.8.8	0x4889	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.434704065 CET	192.168.2.15	8.8.8.8	0x4889	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.293236017 CET	192.168.2.15	8.8.8.8	0x539a	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.433324099 CET	192.168.2.15	8.8.8.8	0x539a	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.575198889 CET	192.168.2.15	8.8.8.8	0x539a	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.715332985 CET	192.168.2.15	8.8.8.8	0x539a	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.854027987 CET	192.168.2.15	8.8.8.8	0x539a	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:49.674932003 CET	192.168.2.15	8.8.8.8	0xdc17	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:49.816450119 CET	192.168.2.15	8.8.8.8	0xdc17	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:49.956183910 CET	192.168.2.15	8.8.8.8	0xdc17	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:50.108350039 CET	192.168.2.15	8.8.8.8	0xdc17	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:50.249175072 CET	192.168.2.15	8.8.8.8	0xdc17	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.181268930 CET	192.168.2.15	8.8.8.8	0x3255	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.346143961 CET	192.168.2.15	8.8.8.8	0x3255	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.507872105 CET	192.168.2.15	8.8.8.8	0x3255	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.786067963 CET	192.168.2.15	8.8.8.8	0x3255	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.946126938 CET	192.168.2.15	8.8.8.8	0x3255	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:09.929582119 CET	192.168.2.15	8.8.8.8	0xc08f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.079857111 CET	192.168.2.15	8.8.8.8	0xc08f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.236474991 CET	192.168.2.15	8.8.8.8	0xc08f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.402389050 CET	192.168.2.15	8.8.8.8	0xc08f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.563417912 CET	192.168.2.15	8.8.8.8	0xc08f	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:21.473689079 CET	192.168.2.15	8.8.8.8	0x7975	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:21.616451979 CET	192.168.2.15	8.8.8.8	0x7975	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:21.768434048 CET	192.168.2.15	8.8.8.8	0x7975	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:21.927370071 CET	192.168.2.15	8.8.8.8	0x7975	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:22.085666895 CET	192.168.2.15	8.8.8.8	0x7975	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:25.988140106 CET	192.168.2.15	8.8.8.8	0x885	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.133985043 CET	192.168.2.15	8.8.8.8	0x885	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.275594950 CET	192.168.2.15	8.8.8.8	0x885	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.419864893 CET	192.168.2.15	8.8.8.8	0x885	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.561276913 CET	192.168.2.15	8.8.8.8	0x885	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.383943081 CET	192.168.2.15	8.8.8.8	0xaf13	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.521524906 CET	192.168.2.15	8.8.8.8	0xaf13	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.659746885 CET	192.168.2.15	8.8.8.8	0xaf13	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.798865080 CET	192.168.2.15	8.8.8.8	0xaf13	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.947571039 CET	192.168.2.15	8.8.8.8	0xaf13	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:32.746696949 CET	192.168.2.15	8.8.8.8	0x3808	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:32.891791105 CET	192.168.2.15	8.8.8.8	0x3808	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:33.029603004 CET	192.168.2.15	8.8.8.8	0x3808	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:33.166587114 CET	192.168.2.15	8.8.8.8	0x3808	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:33.303541899 CET	192.168.2.15	8.8.8.8	0x3808	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.066572905 CET	192.168.2.15	8.8.8.8	0x4d82	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.202430964 CET	192.168.2.15	8.8.8.8	0x4d82	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.338314056 CET	192.168.2.15	8.8.8.8	0x4d82	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.474288940 CET	192.168.2.15	8.8.8.8	0x4d82	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.618175030 CET	192.168.2.15	8.8.8.8	0x4d82	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.391022921 CET	192.168.2.15	8.8.8.8	0x78c6	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.534194946 CET	192.168.2.15	8.8.8.8	0x78c6	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.682183981 CET	192.168.2.15	8.8.8.8	0x78c6	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.818018913 CET	192.168.2.15	8.8.8.8	0x78c6	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.961368084 CET	192.168.2.15	8.8.8.8	0x78c6	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:54.736114025 CET	192.168.2.15	8.8.8.8	0xf19e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:54.871943951 CET	192.168.2.15	8.8.8.8	0xf19e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:55.007189989 CET	192.168.2.15	8.8.8.8	0xf19e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:55.142151117 CET	192.168.2.15	8.8.8.8	0xf19e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:55.285273075 CET	192.168.2.15	8.8.8.8	0xf19e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.063323021 CET	192.168.2.15	8.8.8.8	0x6983	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.204824924 CET	192.168.2.15	8.8.8.8	0x6983	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.339684010 CET	192.168.2.15	8.8.8.8	0x6983	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.481945038 CET	192.168.2.15	8.8.8.8	0x6983	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.622585058 CET	192.168.2.15	8.8.8.8	0x6983	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.412863016 CET	192.168.2.15	8.8.8.8	0x5431	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.550793886 CET	192.168.2.15	8.8.8.8	0x5431	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.686767101 CET	192.168.2.15	8.8.8.8	0x5431	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.824985981 CET	192.168.2.15	8.8.8.8	0x5431	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.968580961 CET	192.168.2.15	8.8.8.8	0x5431	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 17:44:40.801621914 CET	8.8.8.8	192.168.2.15	0x226	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:40.937619925 CET	8.8.8.8	192.168.2.15	0x226	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.077902079 CET	8.8.8.8	192.168.2.15	0x226	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.214052916 CET	8.8.8.8	192.168.2.15	0x226	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.354455948 CET	8.8.8.8	192.168.2.15	0x226	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.491653919 CET	8.8.8.8	192.168.2.15	0x609f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.628474951 CET	8.8.8.8	192.168.2.15	0x609f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.766041040 CET	8.8.8.8	192.168.2.15	0x609f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:41.912895918 CET	8.8.8.8	192.168.2.15	0x609f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:42.049813986 CET	8.8.8.8	192.168.2.15	0x609f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:45.865978003 CET	8.8.8.8	192.168.2.15	0x9526	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:46.009902954 CET	8.8.8.8	192.168.2.15	0x9526	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:46.149147987 CET	8.8.8.8	192.168.2.15	0x9526	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:46.293430090 CET	8.8.8.8	192.168.2.15	0x9526	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:46.432718039 CET	8.8.8.8	192.168.2.15	0x9526	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.208987951 CET	8.8.8.8	192.168.2.15	0xf51d	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.350749969 CET	8.8.8.8	192.168.2.15	0xf51d	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.488162994 CET	8.8.8.8	192.168.2.15	0xf51d	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.624218941 CET	8.8.8.8	192.168.2.15	0xf51d	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:55.759875059 CET	8.8.8.8	192.168.2.15	0xf51d	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.544188023 CET	8.8.8.8	192.168.2.15	0xa5c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.679970980 CET	8.8.8.8	192.168.2.15	0xa5c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.817815065 CET	8.8.8.8	192.168.2.15	0xa5c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:57.953739882 CET	8.8.8.8	192.168.2.15	0xa5c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:44:58.099776983 CET	8.8.8.8	192.168.2.15	0xa5c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:00.870562077 CET	8.8.8.8	192.168.2.15	0xf057	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:00.870562077 CET	8.8.8.8	192.168.2.15	0xf057	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:08.904520035 CET	8.8.8.8	192.168.2.15	0x9517	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:09.049288034 CET	8.8.8.8	192.168.2.15	0x9517	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:09.194690943 CET	8.8.8.8	192.168.2.15	0x9517	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:09.339131117 CET	8.8.8.8	192.168.2.15	0x9517	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:09.475393057 CET	8.8.8.8	192.168.2.15	0x9517	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.259254932 CET	8.8.8.8	192.168.2.15	0x411c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.397475004 CET	8.8.8.8	192.168.2.15	0x411c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.546032906 CET	8.8.8.8	192.168.2.15	0x411c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.690362930 CET	8.8.8.8	192.168.2.15	0x411c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:14.827131033 CET	8.8.8.8	192.168.2.15	0x411c	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:22.592540026 CET	8.8.8.8	192.168.2.15	0x1c2	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:22.728334904 CET	8.8.8.8	192.168.2.15	0x1c2	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:22.864279985 CET	8.8.8.8	192.168.2.15	0x1c2	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:23.000251055 CET	8.8.8.8	192.168.2.15	0x1c2	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:23.136190891 CET	8.8.8.8	192.168.2.15	0x1c2	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:24.910526037 CET	8.8.8.8	192.168.2.15	0xc3f0	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:25.047127962 CET	8.8.8.8	192.168.2.15	0xc3f0	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:25.182729006 CET	8.8.8.8	192.168.2.15	0xc3f0	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:25.318330050 CET	8.8.8.8	192.168.2.15	0xc3f0	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:25.454473019 CET	8.8.8.8	192.168.2.15	0xc3f0	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.242278099 CET	8.8.8.8	192.168.2.15	0x4d7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.379766941 CET	8.8.8.8	192.168.2.15	0x4d7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.518348932 CET	8.8.8.8	192.168.2.15	0x4d7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.654042959 CET	8.8.8.8	192.168.2.15	0x4d7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:33.798115969 CET	8.8.8.8	192.168.2.15	0x4d7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.027614117 CET	8.8.8.8	192.168.2.15	0x4889	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.162887096 CET	8.8.8.8	192.168.2.15	0x4889	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.297923088 CET	8.8.8.8	192.168.2.15	0x4889	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.433223009 CET	8.8.8.8	192.168.2.15	0x4889	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:38.568315029 CET	8.8.8.8	192.168.2.15	0x4889	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.427004099 CET	8.8.8.8	192.168.2.15	0x539a	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.567490101 CET	8.8.8.8	192.168.2.15	0x539a	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.709708929 CET	8.8.8.8	192.168.2.15	0x539a	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.850212097 CET	8.8.8.8	192.168.2.15	0x539a	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:46.987719059 CET	8.8.8.8	192.168.2.15	0x539a	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:49.810297966 CET	8.8.8.8	192.168.2.15	0xdc17	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:49.950952053 CET	8.8.8.8	192.168.2.15	0xdc17	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:50.098119020 CET	8.8.8.8	192.168.2.15	0xdc17	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:50.242516041 CET	8.8.8.8	192.168.2.15	0xdc17	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:45:50.382977009 CET	8.8.8.8	192.168.2.15	0xdc17	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.322940111 CET	8.8.8.8	192.168.2.15	0x3255	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.481836081 CET	8.8.8.8	192.168.2.15	0x3255	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.642214060 CET	8.8.8.8	192.168.2.15	0x3255	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:00.920188904 CET	8.8.8.8	192.168.2.15	0x3255	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:01.080643892 CET	8.8.8.8	192.168.2.15	0x3255	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.069658995 CET	8.8.8.8	192.168.2.15	0xc08f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.214850903 CET	8.8.8.8	192.168.2.15	0xc08f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.378241062 CET	8.8.8.8	192.168.2.15	0xc08f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.536547899 CET	8.8.8.8	192.168.2.15	0xc08f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:10.697680950 CET	8.8.8.8	192.168.2.15	0xc08f	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:21.608086109 CET	8.8.8.8	192.168.2.15	0x7975	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:21.758263111 CET	8.8.8.8	192.168.2.15	0x7975	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:21.913230896 CET	8.8.8.8	192.168.2.15	0x7975	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:22.073220015 CET	8.8.8.8	192.168.2.15	0x7975	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:22.219681025 CET	8.8.8.8	192.168.2.15	0x7975	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.122206926 CET	8.8.8.8	192.168.2.15	0x885	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.267950058 CET	8.8.8.8	192.168.2.15	0x885	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.409328938 CET	8.8.8.8	192.168.2.15	0x885	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.553519011 CET	8.8.8.8	192.168.2.15	0x885	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:26.695379019 CET	8.8.8.8	192.168.2.15	0x885	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.518260002 CET	8.8.8.8	192.168.2.15	0xaf13	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.655375957 CET	8.8.8.8	192.168.2.15	0xaf13	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.794919014 CET	8.8.8.8	192.168.2.15	0xaf13	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:28.941338062 CET	8.8.8.8	192.168.2.15	0xaf13	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:29.082847118 CET	8.8.8.8	192.168.2.15	0xaf13	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:32.888550997 CET	8.8.8.8	192.168.2.15	0x3808	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:33.026360989 CET	8.8.8.8	192.168.2.15	0x3808	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:33.163651943 CET	8.8.8.8	192.168.2.15	0x3808	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:33.300748110 CET	8.8.8.8	192.168.2.15	0x3808	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:33.437351942 CET	8.8.8.8	192.168.2.15	0x3808	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.201179028 CET	8.8.8.8	192.168.2.15	0x4d82	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.336884975 CET	8.8.8.8	192.168.2.15	0x4d82	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.473007917 CET	8.8.8.8	192.168.2.15	0x4d82	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.617022991 CET	8.8.8.8	192.168.2.15	0x4d82	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:38.753554106 CET	8.8.8.8	192.168.2.15	0x4d82	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.533035040 CET	8.8.8.8	192.168.2.15	0x78c6	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.680902958 CET	8.8.8.8	192.168.2.15	0x78c6	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.816936016 CET	8.8.8.8	192.168.2.15	0x78c6	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:47.960289001 CET	8.8.8.8	192.168.2.15	0x78c6	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:48.095877886 CET	8.8.8.8	192.168.2.15	0x78c6	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:54.870630026 CET	8.8.8.8	192.168.2.15	0xf19e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:55.006110907 CET	8.8.8.8	192.168.2.15	0xf19e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:55.141233921 CET	8.8.8.8	192.168.2.15	0xf19e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:55.284090042 CET	8.8.8.8	192.168.2.15	0xf19e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:46:55.428440094 CET	8.8.8.8	192.168.2.15	0xf19e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.203219891 CET	8.8.8.8	192.168.2.15	0x6983	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.338260889 CET	8.8.8.8	192.168.2.15	0x6983	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.480438948 CET	8.8.8.8	192.168.2.15	0x6983	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.621290922 CET	8.8.8.8	192.168.2.15	0x6983	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:06.756917000 CET	8.8.8.8	192.168.2.15	0x6983	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.548888922 CET	8.8.8.8	192.168.2.15	0x5431	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.684923887 CET	8.8.8.8	192.168.2.15	0x5431	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.823024988 CET	8.8.8.8	192.168.2.15	0x5431	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:47:10.966387033 CET	8.8.8.8	192.168.2.15	0x5431	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Aqua.arm5.elf PID: 5548, Parent PID: 5468

General

Start time (UTC):	16:44:39
Start date (UTC):	25/12/2024
Path:	/tmp/Aqua.arm5.elf
Arguments:	/tmp/Aqua.arm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Aqua.arm5.elf PID: 5550, Parent PID: 5548

General

Start time (UTC):	16:44:39
Start date (UTC):	25/12/2024
Path:	/tmp/Aqua.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Aqua.arm5.elf PID: 5552, Parent PID: 5550

General

Start time (UTC):	16:44:39
Start date (UTC):	25/12/2024
Path:	/tmp/Aqua.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: gnome-session-binary PID: 5554, Parent PID: 1498

General

Start time (UTC):	16:44:40
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 5554, Parent PID: 1498

General

Start time (UTC):	16:44:40
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gsd-rfkill PID: 5554, Parent PID: 1498

General

Start time (UTC):	16:44:40
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Chronological Activities

Analysis Process: systemd PID: 5559, Parent PID: 1

General

Start time (UTC):	16:44:40
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-hostnamed PID: 5559, Parent PID: 1

General

Start time (UTC):	16:44:40
Start date (UTC):	25/12/2024
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Chronological Activities

Analysis Process: gdm3 PID: 5707, Parent PID: 1333

General

Start time (UTC):	16:44:41
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5707, Parent PID: 1333

General

Start time (UTC):	16:44:41
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 5711, Parent PID: 1333

General

Start time (UTC):	16:44:41
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5711, Parent PID: 1333

General

Start time (UTC):	16:44:41
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 5712, Parent PID: 1333

General

Start time (UTC):	16:44:42
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5712, Parent PID: 1333

General

Start time (UTC):	16:44:42
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 5717, Parent PID: 1

General

Start time (UTC):	16:44:42
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5717, Parent PID: 1

General

Start time (UTC):	16:44:42
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5730, Parent PID: 3044

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 5730, Parent PID: 3044

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 5731, Parent PID: 1

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-logind PID: 5731, Parent PID: 1

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/lib/systemd/systemd-logind
Arguments:	/lib/systemd/systemd-logind
File size:	268576 bytes
MD5 hash:	8dd58a1b4c12f7a1d5fe3ce18b2aaeef

Chronological Activities

Analysis Process: systemd PID: 5790, Parent PID: 1

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rtkit-daemon PID: 5790, Parent PID: 1

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/libexec/rtkit-daemon
Arguments:	/usr/libexec/rtkit-daemon
File size:	68096 bytes
MD5 hash:	df0cacf1db4ec95ac70f5b6e06b8ffd7

Chronological Activities

Analysis Process: systemd PID: 5791, Parent PID: 1

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5791, Parent PID: 1

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5794, Parent PID: 1

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: polkitd PID: 5794, Parent PID: 1

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/lib/policykit-1/polkitd
Arguments:	/usr/lib/policykit-1/polkitd --no-debug
File size:	121504 bytes
MD5 hash:	8efc9b4b5b524210ad2ea1954a9d0e69

Chronological Activities

Analysis Process: gvfsd-fuse PID: 5798, Parent PID: 3210

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Chronological Activities

Analysis Process: fusermount PID: 5798, Parent PID: 3210

General

Start time (UTC):	16:44:43
Start date (UTC):	25/12/2024
Path:	/bin/fusermount
Arguments:	fusermount -u -q -z -- /run/user/1000/gvfs
File size:	39144 bytes
MD5 hash:	576a1b135c82bdcbc97a91acea900566

Chronological Activities

Analysis Process: systemd PID: 5805, Parent PID: 1

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: agetty PID: 5805, Parent PID: 1

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/sbin/agetty
Arguments:	/sbin/agetty -o "-p -- \\u" --noclear tty2 linux
File size:	69000 bytes
MD5 hash:	3a374724ba7e863768139bdd60ca36f7

Chronological Activities

Analysis Process: systemd PID: 5808, Parent PID: 1

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 5808, Parent PID: 1

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: gpu-manager PID: 5809, Parent PID: 5808

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 5809, Parent PID: 5808

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5810, Parent PID: 5809

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5810, Parent PID: 5809

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 5813, Parent PID: 5808

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 5813, Parent PID: 5808

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5814, Parent PID: 5813

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5814, Parent PID: 5813

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: systemd PID: 5811, Parent PID: 1

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5811, Parent PID: 1

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5815, Parent PID: 1

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5815, Parent PID: 1

General

Start time (UTC):	16:44:44
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5816, Parent PID: 1

General

Start time (UTC):	16:44:49
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: agetty PID: 5816, Parent PID: 1

General

Start time (UTC):	16:44:49
Start date (UTC):	25/12/2024
Path:	/sbin/agetty
Arguments:	/sbin/agetty -o "-p -- \\u" --noclear tty2 linux
File size:	69000 bytes
MD5 hash:	3a374724ba7e863768139bdd60ca36f7

Chronological Activities

Analysis Process: systemd PID: 5817, Parent PID: 1

General

Start time (UTC):	16:44:45
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 5817, Parent PID: 1

General

Start time (UTC):	16:44:45
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 5818, Parent PID: 5817

General

Start time (UTC):	16:44:45
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5818, Parent PID: 5817

General

Start time (UTC):	16:44:45
Start date (UTC):	25/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 5824, Parent PID: 1

General

Start time (UTC):	16:44:47
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-logind PID: 5824, Parent PID: 1

General

Start time (UTC):	16:44:47
Start date (UTC):	25/12/2024
Path:	/lib/systemd/systemd-logind
Arguments:	/lib/systemd/systemd-logind
File size:	268576 bytes
MD5 hash:	8dd58a1b4c12f7a1d5fe3ce18b2aaeef

Chronological Activities

Analysis Process: systemd PID: 5881, Parent PID: 1

General

Start time (UTC):	16:44:48
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gdm-wait-for-drm PID: 5881, Parent PID: 1

General

Start time (UTC):	16:44:48
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-wait-for-drm
Arguments:	/usr/lib/gdm3/gdm-wait-for-drm
File size:	14640 bytes
MD5 hash:	82043ba752c6930b4e6aaea2f7747545

Chronological Activities

Analysis Process: systemd PID: 5905, Parent PID: 1

General

Start time (UTC):	16:44:56
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5905, Parent PID: 1

General

Start time (UTC):	16:44:56
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5906, Parent PID: 1

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: agetty PID: 5906, Parent PID: 1

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/sbin/agetty
Arguments:	/sbin/agetty -o "-p -- \\u" --noclear tty2 linux
File size:	69000 bytes
MD5 hash:	3a374724ba7e863768139bdd60ca36f7

Chronological Activities

Analysis Process: systemd PID: 5914, Parent PID: 1

General

Start time (UTC):	16:44:57
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5914, Parent PID: 1

General

Start time (UTC):	16:44:57
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5918, Parent PID: 1

General

Start time (UTC):	16:44:59
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-logind PID: 5918, Parent PID: 1

General

Start time (UTC):	16:44:59
Start date (UTC):	25/12/2024
Path:	/lib/systemd/systemd-logind
Arguments:	/lib/systemd/systemd-logind
File size:	268576 bytes
MD5 hash:	8dd58a1b4c12f7a1d5fe3ce18b2aaeef

Chronological Activities

Analysis Process: systemd PID: 5978, Parent PID: 1

General

Start time (UTC):	16:44:59
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gdm3 PID: 5978, Parent PID: 1

General

Start time (UTC):	16:44:59
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	/usr/sbin/gdm3
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: gdm3 PID: 5981, Parent PID: 5978

General

Start time (UTC):	16:45:00
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: plymouth PID: 5981, Parent PID: 5978

General

Start time (UTC):	16:45:00
Start date (UTC):	25/12/2024
Path:	/usr/bin/plymouth
Arguments:	plymouth --ping
File size:	51352 bytes
MD5 hash:	87003efd8dad470042f5e75360a8f49f

Chronological Activities

Analysis Process: gdm3 PID: 5995, Parent PID: 5978

General

Start time (UTC):	16:45:03
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: gdm-session-worker PID: 5995, Parent PID: 5978

General

Start time (UTC):	16:45:03
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	"gdm-session-worker [pam/gdm-launch-environment]"
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Chronological Activities

Analysis Process: gdm-session-worker PID: 6001, Parent PID: 5995

General

Start time (UTC):	16:45:05
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Chronological Activities

Analysis Process: gdm-wayland-session PID: 6001, Parent PID: 5995

General

Start time (UTC):	16:45:05
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	/usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Chronological Activities

Analysis Process: gdm-wayland-session PID: 6005, Parent PID: 6001

General

Start time (UTC):	16:45:06
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Chronological Activities

Analysis Process: dbus-run-session PID: 6005, Parent PID: 6001

General

Start time (UTC):	16:45:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: dbus-run-session PID: 6006, Parent PID: 6005

General

Start time (UTC):	16:45:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: dbus-daemon PID: 6006, Parent PID: 6005

General

Start time (UTC):	16:45:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --nofork --print-address 4 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6010, Parent PID: 6006

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6011, Parent PID: 6010

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6011, Parent PID: 6010

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6013, Parent PID: 6006

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6014, Parent PID: 6013

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6014, Parent PID: 6013

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6015, Parent PID: 6006

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6016, Parent PID: 6015

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6016, Parent PID: 6015

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6017, Parent PID: 6006

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6018, Parent PID: 6017

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6018, Parent PID: 6017

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6019, Parent PID: 6006

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6020, Parent PID: 6019

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6020, Parent PID: 6019

General

Start time (UTC):	16:45:07
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6021, Parent PID: 6006

General

Start time (UTC):	16:45:08
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6022, Parent PID: 6021

General

Start time (UTC):	16:45:08
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6022, Parent PID: 6021

General

Start time (UTC):	16:45:08
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6024, Parent PID: 6006

General

Start time (UTC):	16:45:08
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6025, Parent PID: 6024

General

Start time (UTC):	16:45:08
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6025, Parent PID: 6024

General

Start time (UTC):	16:45:08
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-run-session PID: 6007, Parent PID: 6005

General

Start time (UTC):	16:45:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: gnome-session PID: 6007, Parent PID: 6005

General

Start time (UTC):	16:45:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/gnome-session
Arguments:	gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-session-binary PID: 6007, Parent PID: 6005

General

Start time (UTC):	16:45:06
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	/usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: gnome-session-binary PID: 6026, Parent PID: 6007

General

Start time (UTC):	16:45:08
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: session-migration PID: 6026, Parent PID: 6007

General

Start time (UTC):	16:45:08
Start date (UTC):	25/12/2024
Path:	/usr/bin/session-migration
Arguments:	session-migration
File size:	22680 bytes
MD5 hash:	5227af42ebf14ac2fe2acddb002f68dc

Chronological Activities

Analysis Process: gnome-session-binary PID: 6029, Parent PID: 6007

General

Start time (UTC):	16:45:09
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 6029, Parent PID: 6007

General

Start time (UTC):	16:45:09
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-shell PID: 6029, Parent PID: 6007

General

Start time (UTC):	16:45:09
Start date (UTC):	25/12/2024
Path:	/usr/bin/gnome-shell
Arguments:	/usr/bin/gnome-shell
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

Chronological Activities

Analysis Process: gdm3 PID: 6035, Parent PID: 5978

General

Start time (UTC):	16:45:11
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: gdm-session-worker PID: 6035, Parent PID: 5978

General

Start time (UTC):	16:45:11
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	"gdm-session-worker [pam/gdm-launch-environment]"
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Chronological Activities

Analysis Process: gdm-session-worker PID: 6040, Parent PID: 6035

General

Start time (UTC):	16:45:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Chronological Activities

Analysis Process: gdm-x-session PID: 6040, Parent PID: 6035

General

Start time (UTC):	16:45:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	/usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Chronological Activities

Analysis Process: gdm-x-session PID: 6042, Parent PID: 6040

General

Start time (UTC):	16:45:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Chronological Activities

Analysis Process: Xorg PID: 6042, Parent PID: 6040

General

Start time (UTC):	16:45:13
Start date (UTC):	25/12/2024
Path:	/usr/bin/Xorg
Arguments:	/usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: Xorg.wrap PID: 6042, Parent PID: 6040

General

Start time (UTC):	16:45:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/xorg/Xorg.wrap
Arguments:	/usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3
File size:	14488 bytes
MD5 hash:	48993830888200ecf19dd7def0884dfd

Chronological Activities

Analysis Process: Xorg PID: 6042, Parent PID: 6040

General

Start time (UTC):	16:45:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	/usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Chronological Activities

Analysis Process: Xorg PID: 6051, Parent PID: 6042

General

Start time (UTC):	16:45:21
Start date (UTC):	25/12/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Chronological Activities

Analysis Process: sh PID: 6051, Parent PID: 6042

General

Start time (UTC):	16:45:21
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6052, Parent PID: 6051

General

Start time (UTC):	16:45:21
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: xkbcomp PID: 6052, Parent PID: 6051

General

Start time (UTC):	16:45:21
Start date (UTC):	25/12/2024
Path:	/usr/bin/xkbcomp
Arguments:	/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm
File size:	217184 bytes
MD5 hash:	c5f953aec4c00d2a1cc27acb75d62c9b

Chronological Activities

Analysis Process: Xorg PID: 6293, Parent PID: 6042

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Chronological Activities

Analysis Process: sh PID: 6293, Parent PID: 6042

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6294, Parent PID: 6293

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: xkbcomp PID: 6294, Parent PID: 6293

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/bin/xkbcomp
Arguments:	/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm
File size:	217184 bytes
MD5 hash:	c5f953aec4c00d2a1cc27acb75d62c9b

Chronological Activities

Analysis Process: gdm-x-session PID: 6057, Parent PID: 6040

General

Start time (UTC):	16:45:25
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Chronological Activities

Analysis Process: Default PID: 6057, Parent PID: 6040

General

Start time (UTC):	16:45:25
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/Prime/Default
Arguments:	/etc/gdm3/Prime/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm-x-session PID: 6058, Parent PID: 6040

General

Start time (UTC):	16:45:25
Start date (UTC):	25/12/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Chronological Activities

Analysis Process: dbus-run-session PID: 6058, Parent PID: 6040

General

Start time (UTC):	16:45:25
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: dbus-run-session PID: 6059, Parent PID: 6058

General

Start time (UTC):	16:45:25
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: dbus-daemon PID: 6059, Parent PID: 6058

General

Start time (UTC):	16:45:25
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --nofork --print-address 4 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6073, Parent PID: 6059

General

Start time (UTC):	16:45:30
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6074, Parent PID: 6073

General

Start time (UTC):	16:45:30
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: at-spi-bus-launcher PID: 6074, Parent PID: 6073

General

Start time (UTC):	16:45:30
Start date (UTC):	25/12/2024
Path:	/usr/libexec/at-spi-bus-launcher
Arguments:	/usr/libexec/at-spi-bus-launcher
File size:	27008 bytes
MD5 hash:	1563f274acd4e7ba530a55bdc4c95682

Chronological Activities

Analysis Process: at-spi-bus-launcher PID: 6079, Parent PID: 6074

General

Start time (UTC):	16:45:30
Start date (UTC):	25/12/2024
Path:	/usr/libexec/at-spi-bus-launcher
Arguments:	-
File size:	27008 bytes
MD5 hash:	1563f274acd4e7ba530a55bdc4c95682

Chronological Activities

Analysis Process: dbus-daemon PID: 6079, Parent PID: 6074

General

Start time (UTC):	16:45:30
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6454, Parent PID: 6079

General

Start time (UTC):	16:45:45
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6455, Parent PID: 6454

General

Start time (UTC):	16:45:45
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: at-spi2-registryd PID: 6455, Parent PID: 6454

General

Start time (UTC):	16:45:45
Start date (UTC):	25/12/2024
Path:	/usr/libexec/at-spi2-registryd
Arguments:	/usr/libexec/at-spi2-registryd --use-gnome-session
File size:	100224 bytes
MD5 hash:	1d904c2693452edebc7ede3a9e24d440

Chronological Activities

Analysis Process: dbus-daemon PID: 6101, Parent PID: 6059

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6102, Parent PID: 6101

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6102, Parent PID: 6101

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6104, Parent PID: 6059

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6105, Parent PID: 6104

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6105, Parent PID: 6104

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6106, Parent PID: 6059

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6107, Parent PID: 6106

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6107, Parent PID: 6106

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6108, Parent PID: 6059

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6109, Parent PID: 6108

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6109, Parent PID: 6108

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6110, Parent PID: 6059

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6111, Parent PID: 6110

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6111, Parent PID: 6110

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6112, Parent PID: 6059

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6113, Parent PID: 6112

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6113, Parent PID: 6112

General

Start time (UTC):	16:45:32
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6115, Parent PID: 6059

General

Start time (UTC):	16:45:33
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6116, Parent PID: 6115

General

Start time (UTC):	16:45:33
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6116, Parent PID: 6115

General

Start time (UTC):	16:45:33
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6295, Parent PID: 6059

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6296, Parent PID: 6295

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: ibus-portal PID: 6296, Parent PID: 6295

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/libexec/ibus-portal
Arguments:	/usr/libexec/ibus-portal
File size:	92536 bytes
MD5 hash:	562ad55bd9a4d54bd7b76746b01e37d3

Chronological Activities

Analysis Process: dbus-daemon PID: 6471, Parent PID: 6059

General

Start time (UTC):	16:45:49
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6472, Parent PID: 6471

General

Start time (UTC):	16:45:49
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: gjs PID: 6472, Parent PID: 6471

General

Start time (UTC):	16:45:49
Start date (UTC):	25/12/2024
Path:	/usr/bin/gjs
Arguments:	/usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications
File size:	23128 bytes
MD5 hash:	5f3eceb792bb65c22f23d1efb4fde3ad

Chronological Activities

Analysis Process: dbus-daemon PID: 6689, Parent PID: 6059

General

Start time (UTC):	16:46:02
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6690, Parent PID: 6689

General

Start time (UTC):	16:46:02
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6690, Parent PID: 6689

General

Start time (UTC):	16:46:02
Start date (UTC):	25/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-run-session PID: 6060, Parent PID: 6058

General

Start time (UTC):	16:45:25
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: gnome-session PID: 6060, Parent PID: 6058

General

Start time (UTC):	16:45:26
Start date (UTC):	25/12/2024
Path:	/usr/bin/gnome-session
Arguments:	gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-session-binary PID: 6060, Parent PID: 6058

General

Start time (UTC):	16:45:26
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	/usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: gnome-session-binary PID: 6061, Parent PID: 6060

General

Start time (UTC):	16:45:26
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: gnome-session-check-accelerated PID: 6061, Parent PID: 6060

General

Start time (UTC):	16:45:26
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-check-accelerated
Arguments:	/usr/libexec/gnome-session-check-accelerated
File size:	18752 bytes
MD5 hash:	a64839518af85b2b9de31aca27646396

Chronological Activities

Analysis Process: gnome-session-check-accelerated PID: 6080, Parent PID: 6061

General

Start time (UTC):	16:45:30
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-check-accelerated
Arguments:	-
File size:	18752 bytes
MD5 hash:	a64839518af85b2b9de31aca27646396

Chronological Activities

Analysis Process: gnome-session-check-accelerated-gl-helper PID: 6080, Parent PID: 6061

General

Start time (UTC):	16:45:30
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-check-accelerated-gl-helper
Arguments:	/usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer
File size:	22920 bytes
MD5 hash:	b1ab9a384f9e98a39ae5c36037dd5e78

Chronological Activities

Analysis Process: gnome-session-check-accelerated PID: 6090, Parent PID: 6061

General

Start time (UTC):	16:45:31
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-check-accelerated
Arguments:	-
File size:	18752 bytes
MD5 hash:	a64839518af85b2b9de31aca27646396

Chronological Activities

Analysis Process: gnome-session-check-accelerated-gles-helper PID: 6090, Parent PID: 6061

General

Start time (UTC):	16:45:31
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-check-accelerated-gles-helper
Arguments:	/usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer
File size:	14728 bytes
MD5 hash:	1bd78885765a18e60c05ed1fb5fa3bf8

Chronological Activities

Analysis Process: gnome-session-binary PID: 6117, Parent PID: 6060

General

Start time (UTC):	16:45:33
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: session-migration PID: 6117, Parent PID: 6060

General

Start time (UTC):	16:45:33
Start date (UTC):	25/12/2024
Path:	/usr/bin/session-migration
Arguments:	session-migration
File size:	22680 bytes
MD5 hash:	5227af42ebf14ac2fe2acddb002f68dc

Chronological Activities

Analysis Process: gnome-session-binary PID: 6118, Parent PID: 6060

General

Start time (UTC):	16:45:33
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 6118, Parent PID: 6060

General

Start time (UTC):	16:45:33
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-shell PID: 6118, Parent PID: 6060

General

Start time (UTC):	16:45:33
Start date (UTC):	25/12/2024
Path:	/usr/bin/gnome-shell
Arguments:	/usr/bin/gnome-shell
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

Chronological Activities

Analysis Process: gnome-shell PID: 6260, Parent PID: 6118

General

Start time (UTC):	16:45:41
Start date (UTC):	25/12/2024
Path:	/usr/bin/gnome-shell
Arguments:	-
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

Analysis Process: ibus-daemon PID: 6260, Parent PID: 6118

General

Start time (UTC):	16:45:41
Start date (UTC):	25/12/2024
Path:	/usr/bin/ibus-daemon
Arguments:	ibus-daemon --panel disable --xim
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-daemon PID: 6289, Parent PID: 6260

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/bin/ibus-daemon
Arguments:	-
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-memconf PID: 6289, Parent PID: 6260

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/libexec/ibus-memconf
Arguments:	/usr/libexec/ibus-memconf
File size:	22904 bytes
MD5 hash:	523e939905910d06598e66385761a822

Analysis Process: ibus-daemon PID: 6291, Parent PID: 6260

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/bin/ibus-daemon
Arguments:	-
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-daemon PID: 6292, Parent PID: 6291

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/bin/ibus-daemon
Arguments:	-
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-x11 PID: 6292, Parent PID: 1

General

Start time (UTC):	16:45:42
Start date (UTC):	25/12/2024
Path:	/usr/libexec/ibus-x11
Arguments:	/usr/libexec/ibus-x11 --kill-daemon
File size:	100352 bytes
MD5 hash:	2aa1e54666191243814c2733d6992dbd

Analysis Process: ibus-daemon PID: 6501, Parent PID: 6260

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/usr/bin/ibus-daemon
Arguments:	-
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-engine-simple PID: 6501, Parent PID: 6260

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/usr/libexec/ibus-engine-simple
Arguments:	/usr/libexec/ibus-engine-simple
File size:	14712 bytes
MD5 hash:	0238866d5e8802a0ce1b1b9af8cb1376

Analysis Process: gnome-session-binary PID: 6486, Parent PID: 6060

General

Start time (UTC):	16:45:52
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6486, Parent PID: 6060

General

Start time (UTC):	16:45:52
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-sharing PID: 6486, Parent PID: 6060

General

Start time (UTC):	16:45:52
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-sharing
Arguments:	/usr/libexec/gsd-sharing
File size:	35424 bytes
MD5 hash:	e29d9025d98590fbb69f89fdbd4438b3

Analysis Process: gnome-session-binary PID: 6488, Parent PID: 6060

General

Start time (UTC):	16:45:52
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6488, Parent PID: 6060

General

Start time (UTC):	16:45:52
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-wacom PID: 6488, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-wacom
Arguments:	/usr/libexec/gsd-wacom
File size:	39520 bytes
MD5 hash:	13778dd1a23a4e94ddc17ac9caa4fcc1

Analysis Process: gnome-session-binary PID: 6491, Parent PID: 6060

General

Start time (UTC):	16:45:52
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6491, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-color PID: 6491, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-color
Arguments:	/usr/libexec/gsd-color
File size:	92832 bytes
MD5 hash:	ac2861ad93ce047283e8e87cefef9a19

Analysis Process: gnome-session-binary PID: 6492, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6492, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-keyboard PID: 6492, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-keyboard
Arguments:	/usr/libexec/gsd-keyboard
File size:	39760 bytes
MD5 hash:	8e288fd17c80bb0a1148b964b2ac2279

Analysis Process: gnome-session-binary PID: 6493, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6493, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-print-notifications PID: 6493, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-print-notifications
Arguments:	/usr/libexec/gsd-print-notifications
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Analysis Process: gsd-print-notifications PID: 6523, Parent PID: 6493

General

Start time (UTC):	16:45:59
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-print-notifications
Arguments:	-
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Analysis Process: gsd-print-notifications PID: 6524, Parent PID: 6523

General

Start time (UTC):	16:45:59
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-print-notifications
Arguments:	-
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Analysis Process: gsd-printer PID: 6524, Parent PID: 1

General

Start time (UTC):	16:45:59
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-printer
Arguments:	/usr/libexec/gsd-printer
File size:	31120 bytes
MD5 hash:	7995828cf98c315fd55f2ffb3b22384d

Analysis Process: gnome-session-binary PID: 6494, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6494, Parent PID: 6060

General

Start time (UTC):	16:45:53
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-rfkill PID: 6494, Parent PID: 6060

General

Start time (UTC):	16:45:54
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Analysis Process: gnome-session-binary PID: 6495, Parent PID: 6060

General

Start time (UTC):	16:45:54
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6495, Parent PID: 6060

General

Start time (UTC):	16:45:54
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-smartcard PID: 6495, Parent PID: 6060

General

Start time (UTC):	16:45:54
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-smartcard
Arguments:	/usr/libexec/gsd-smartcard
File size:	109152 bytes
MD5 hash:	ea1fbd7f62e4cd0331eae2ef754ee605

Analysis Process: gnome-session-binary PID: 6498, Parent PID: 6060

General

Start time (UTC):	16:45:54
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6498, Parent PID: 6060

General

Start time (UTC):	16:45:54
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-datetime PID: 6498, Parent PID: 6060

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-datetime
Arguments:	/usr/libexec/gsd-datetime
File size:	76736 bytes
MD5 hash:	d80d39745740de37d6634d36e344d4bc

Analysis Process: gnome-session-binary PID: 6499, Parent PID: 6060

General

Start time (UTC):	16:45:54
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6499, Parent PID: 6060

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-media-keys PID: 6499, Parent PID: 6060

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-media-keys
Arguments:	/usr/libexec/gsd-media-keys
File size:	232936 bytes
MD5 hash:	a425448c135afb4b8bfd79cc0b6b74da

Analysis Process: gnome-session-binary PID: 6502, Parent PID: 6060

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6502, Parent PID: 6060

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-screensaver-proxy PID: 6502, Parent PID: 6060

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-screensaver-proxy
Arguments:	/usr/libexec/gsd-screensaver-proxy
File size:	27232 bytes
MD5 hash:	77e309450c87dceee43f1a9e50cc0d02

Analysis Process: gnome-session-binary PID: 6505, Parent PID: 6060

General

Start time (UTC):	16:45:55
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6505, Parent PID: 6060

General

Start time (UTC):	16:45:56
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-sound PID: 6505, Parent PID: 6060

General

Start time (UTC):	16:45:56
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-sound
Arguments:	/usr/libexec/gsd-sound
File size:	31248 bytes
MD5 hash:	4c7d3fb993463337b4a0eb5c80c760ee

Analysis Process: gnome-session-binary PID: 6508, Parent PID: 6060

General

Start time (UTC):	16:45:56
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6508, Parent PID: 6060

General

Start time (UTC):	16:45:56
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-a11y-settings PID: 6508, Parent PID: 6060

General

Start time (UTC):	16:45:56
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-a11y-settings
Arguments:	/usr/libexec/gsd-a11y-settings
File size:	23056 bytes
MD5 hash:	18e243d2cf30ecee7ea89d1462725c5c

Analysis Process: gnome-session-binary PID: 6510, Parent PID: 6060

General

Start time (UTC):	16:45:56
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6510, Parent PID: 6060

General

Start time (UTC):	16:45:57
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-housekeeping PID: 6510, Parent PID: 6060

General

Start time (UTC):	16:45:57
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Analysis Process: gnome-session-binary PID: 6513, Parent PID: 6060

General

Start time (UTC):	16:45:57
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6513, Parent PID: 6060

General

Start time (UTC):	16:45:57
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-power PID: 6513, Parent PID: 6060

General

Start time (UTC):	16:45:57
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gsd-power
Arguments:	/usr/libexec/gsd-power
File size:	88672 bytes
MD5 hash:	28b8e1b43c3e7f1db6741ea1ecd978b7

Analysis Process: gnome-session-binary PID: 6798, Parent PID: 6060

General

Start time (UTC):	16:46:19
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6798, Parent PID: 6060

General

Start time (UTC):	16:46:19
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: spice-vdagent PID: 6798, Parent PID: 6060

General

Start time (UTC):	16:46:19
Start date (UTC):	25/12/2024
Path:	/usr/bin/spice-vdagent
Arguments:	/usr/bin/spice-vdagent
File size:	80664 bytes
MD5 hash:	80fb7f613aa78d1b8a229dbcf4577a9d

Analysis Process: gnome-session-binary PID: 6815, Parent PID: 6060

General

Start time (UTC):	16:46:22
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6815, Parent PID: 6060

General

Start time (UTC):	16:46:22
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: xbrlapi PID: 6815, Parent PID: 6060

General

Start time (UTC):	16:46:23
Start date (UTC):	25/12/2024
Path:	/usr/bin/xbrlapi
Arguments:	xbrlapi -q
File size:	166384 bytes
MD5 hash:	0cfe25df39d38af32d6265ed947ca5b9

Analysis Process: gdm3 PID: 6036, Parent PID: 5978

General

Start time (UTC):	16:45:11
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Analysis Process: Default PID: 6036, Parent PID: 5978

General

Start time (UTC):	16:45:12
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gdm3 PID: 6037, Parent PID: 5978

General

Start time (UTC):	16:45:12
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Analysis Process: Default PID: 6037, Parent PID: 5978

General

Start time (UTC):	16:45:12
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: systemd PID: 5982, Parent PID: 1

General

Start time (UTC):	16:45:00
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: accounts-daemon PID: 5982, Parent PID: 1

General

Start time (UTC):	16:45:00
Start date (UTC):	25/12/2024
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	/usr/lib/accountsservice/accounts-daemon
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Analysis Process: accounts-daemon PID: 5986, Parent PID: 5982

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	-
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Analysis Process: language-validate PID: 5986, Parent PID: 5982

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/usr/share/language-tools/language-validate
Arguments:	/usr/share/language-tools/language-validate en_US.UTF-8
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: language-validate PID: 5987, Parent PID: 5986

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/usr/share/language-tools/language-validate
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: language-options PID: 5987, Parent PID: 5986

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/usr/share/language-tools/language-options
Arguments:	/usr/share/language-tools/language-options
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Analysis Process: language-options PID: 5988, Parent PID: 5987

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/usr/share/language-tools/language-options
Arguments:	-
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Analysis Process: sh PID: 5988, Parent PID: 5987

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "locale -a \| grep -F .utf8 "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5989, Parent PID: 5988

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: locale PID: 5989, Parent PID: 5988

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/usr/bin/locale
Arguments:	locale -a
File size:	58944 bytes
MD5 hash:	c72a78792469db86d91369c9057f20d2

Analysis Process: sh PID: 5990, Parent PID: 5988

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: grep PID: 5990, Parent PID: 5988

General

Start time (UTC):	16:45:01
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -F .utf8
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Analysis Process: systemd PID: 5991, Parent PID: 1

General

Start time (UTC):	16:45:02
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: polkitd PID: 5991, Parent PID: 1

General

Start time (UTC):	16:45:02
Start date (UTC):	25/12/2024
Path:	/usr/lib/policykit-1/polkitd
Arguments:	/usr/lib/policykit-1/polkitd --no-debug
File size:	121504 bytes
MD5 hash:	8efc9b4b5b524210ad2ea1954a9d0e69

Analysis Process: systemd PID: 6003, Parent PID: 1431

General

Start time (UTC):	16:45:05
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: dbus-daemon PID: 6003, Parent PID: 1431

General

Start time (UTC):	16:45:05
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Analysis Process: systemd PID: 6140, Parent PID: 1

General

Start time (UTC):	16:45:41
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: systemd-localed PID: 6140, Parent PID: 1

General

Start time (UTC):	16:45:41
Start date (UTC):	25/12/2024
Path:	/lib/systemd/systemd-localed
Arguments:	/lib/systemd/systemd-localed
File size:	43232 bytes
MD5 hash:	1244af9646256d49594f2a8203329aa9

Analysis Process: systemd PID: 6303, Parent PID: 1

General

Start time (UTC):	16:45:44
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: upowerd PID: 6303, Parent PID: 1

General

Start time (UTC):	16:45:44
Start date (UTC):	25/12/2024
Path:	/usr/lib/upower/upowerd
Arguments:	/usr/lib/upower/upowerd
File size:	260328 bytes
MD5 hash:	1253eea2fe5fe4017069664284e326cd

Analysis Process: systemd PID: 6343, Parent PID: 1431

General

Start time (UTC):	16:45:44
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: pulseaudio PID: 6343, Parent PID: 1431

General

Start time (UTC):	16:45:44
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Analysis Process: systemd PID: 6346, Parent PID: 1

General

Start time (UTC):	16:45:45
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: geoclue PID: 6346, Parent PID: 1

General

Start time (UTC):	16:45:45
Start date (UTC):	25/12/2024
Path:	/usr/libexec/geoclue
Arguments:	/usr/libexec/geoclue
File size:	301544 bytes
MD5 hash:	30ac5455f3c598dde91dc87477fb19f7

Analysis Process: systemd PID: 6451, Parent PID: 1

General

Start time (UTC):	16:45:45
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: rtkit-daemon PID: 6451, Parent PID: 1

General

Start time (UTC):	16:45:45
Start date (UTC):	25/12/2024
Path:	/usr/libexec/rtkit-daemon
Arguments:	/usr/libexec/rtkit-daemon
File size:	68096 bytes
MD5 hash:	df0cacf1db4ec95ac70f5b6e06b8ffd7

Analysis Process: systemd PID: 6464, Parent PID: 1

General

Start time (UTC):	16:45:46
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: wpa_supplicant PID: 6464, Parent PID: 1

General

Start time (UTC):	16:45:46
Start date (UTC):	25/12/2024
Path:	/sbin/wpa_supplicant
Arguments:	/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
File size:	2893136 bytes
MD5 hash:	2a5acf2a7a908a1388a09991ed7881e1

Analysis Process: systemd PID: 6465, Parent PID: 1

General

Start time (UTC):	16:45:47
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: avahi-daemon PID: 6465, Parent PID: 1

General

Start time (UTC):	16:45:47
Start date (UTC):	25/12/2024
Path:	/usr/sbin/avahi-daemon
Arguments:	/usr/sbin/avahi-daemon -s
File size:	141832 bytes
MD5 hash:	0125e88392fec809934928f8638511ff

Analysis Process: avahi-daemon PID: 6466, Parent PID: 6465

General

Start time (UTC):	16:45:47
Start date (UTC):	25/12/2024
Path:	/usr/sbin/avahi-daemon
Arguments:	-
File size:	141832 bytes
MD5 hash:	0125e88392fec809934928f8638511ff

Analysis Process: systemd PID: 6469, Parent PID: 1

General

Start time (UTC):	16:45:48
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: packagekitd PID: 6469, Parent PID: 1

General

Start time (UTC):	16:45:48
Start date (UTC):	25/12/2024
Path:	/usr/lib/packagekit/packagekitd
Arguments:	/usr/lib/packagekit/packagekitd
File size:	289288 bytes
MD5 hash:	46b0c31f013b71a0eb63b1c040f11c86

Analysis Process: packagekitd PID: 6490, Parent PID: 6469

General

Start time (UTC):	16:45:52
Start date (UTC):	25/12/2024
Path:	/usr/lib/packagekit/packagekitd
Arguments:	-
File size:	289288 bytes
MD5 hash:	46b0c31f013b71a0eb63b1c040f11c86

Analysis Process: dpkg PID: 6490, Parent PID: 6469

General

Start time (UTC):	16:45:52
Start date (UTC):	25/12/2024
Path:	/usr/bin/dpkg
Arguments:	/usr/bin/dpkg --print-foreign-architectures
File size:	309944 bytes
MD5 hash:	5e18156b434fc45062eec2f28b9147be

Analysis Process: systemd PID: 6529, Parent PID: 1

General

Start time (UTC):	16:45:59
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: systemd-hostnamed PID: 6529, Parent PID: 1

General

Start time (UTC):	16:45:59
Start date (UTC):	25/12/2024
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Analysis Process: systemd PID: 6716, Parent PID: 1

General

Start time (UTC):	16:46:06
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: colord PID: 6716, Parent PID: 1

General

Start time (UTC):	16:46:06
Start date (UTC):	25/12/2024
Path:	/usr/libexec/colord
Arguments:	/usr/libexec/colord
File size:	346632 bytes
MD5 hash:	70861d1b2818c9279cd4a5c9035dac1f

Analysis Process: colord PID: 6793, Parent PID: 6716

General

Start time (UTC):	16:46:18
Start date (UTC):	25/12/2024
Path:	/usr/libexec/colord
Arguments:	-
File size:	346632 bytes
MD5 hash:	70861d1b2818c9279cd4a5c9035dac1f

Analysis Process: colord-sane PID: 6793, Parent PID: 6716

General

Start time (UTC):	16:46:18
Start date (UTC):	25/12/2024
Path:	/usr/libexec/colord-sane
Arguments:	/usr/libexec/colord-sane
File size:	18736 bytes
MD5 hash:	5f98d754a07bf1385c3ff001cde3882e

Analysis Process: systemd PID: 6743, Parent PID: 1

General

Start time (UTC):	16:46:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: ModemManager PID: 6743, Parent PID: 1

General

Start time (UTC):	16:46:13
Start date (UTC):	25/12/2024
Path:	/usr/sbin/ModemManager
Arguments:	/usr/sbin/ModemManager --filter-policy=strict
File size:	1588448 bytes
MD5 hash:	24379bf705a8ff3b2379314585843d4f

Analysis Process: systemd PID: 6778, Parent PID: 3044

General

Start time (UTC):	16:46:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: dbus-daemon PID: 6778, Parent PID: 3044

General

Start time (UTC):	16:46:13
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Analysis Process: systemd PID: 6779, Parent PID: 3044

General

Start time (UTC):	16:46:14
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: pulseaudio PID: 6779, Parent PID: 3044

General

Start time (UTC):	16:46:14
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Analysis Process: systemd PID: 6816, Parent PID: 1

General

Start time (UTC):	16:46:22
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: fprintd PID: 6816, Parent PID: 1

General

Start time (UTC):	16:46:22
Start date (UTC):	25/12/2024
Path:	/usr/libexec/fprintd
Arguments:	/usr/libexec/fprintd
File size:	125312 bytes
MD5 hash:	b0d8829f05cd028529b84b061b660e84

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.arm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6011/oom_score_adj

/proc/6014/oom_score_adj

/proc/6016/oom_score_adj

/proc/6018/oom_score_adj

/proc/6020/oom_score_adj

/proc/6022/oom_score_adj

/proc/6025/oom_score_adj

/proc/6074/oom_score_adj

/proc/6102/oom_score_adj

/proc/6105/oom_score_adj

/proc/6107/oom_score_adj

/proc/6109/oom_score_adj

/proc/6111/oom_score_adj

/proc/6113/oom_score_adj

/proc/6116/oom_score_adj

/proc/6296/oom_score_adj

/proc/6455/oom_score_adj

/proc/6472/oom_score_adj

/proc/6690/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1aytZsF

/run/systemd/inhibit/.#2t9Sc1I

/run/systemd/inhibit/.#3i3aUvI

/run/systemd/inhibit/.#4EuBOhG

/run/systemd/inhibit/.#5gzYi4G

/run/systemd/seats/.#seat00bKj5v

/run/systemd/seats/.#seat06bxeTI

/run/systemd/seats/.#seat0QNkJIH

Linux Analysis Report
Aqua.arm5.elf