Edit tour

Linux Analysis Report
ngwa5.elf

Overview

General Information

Sample name:	ngwa5.elf
Analysis ID:	1585018
MD5:	86553d36841e35d034d3798a7d96537f
SHA1:	fe90d24f9237c911b14836991fa0241e781bd0c4
SHA256:	26a24796548c4054f85669c3d83b79f07653baf63aeeee9a5058eed6a07b6c94
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585018
Start date and time:	2025-01-07 00:47:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ngwa5.elf
Detection:	MAL
Classification:	mal68.spre.troj.evad.linELF@0/102@213/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: ngwa5.elf

Runtime Messages

Command:	/tmp/ngwa5.elf
PID:	5722
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

ngwa5.elf (PID: 5722, Parent: 5527, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/ngwa5.elf

ngwa5.elf New Fork (PID: 5724, Parent: 5722)

ngwa5.elf New Fork (PID: 5726, Parent: 5724)

gnome-session-binary New Fork (PID: 5728, Parent: 1588)

sh (PID: 5728, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5728, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5733, Parent: 1)

systemd-hostnamed (PID: 5733, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 5826, Parent: 1400)

Default (PID: 5826, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5885, Parent: 1400)

Default (PID: 5885, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5886, Parent: 1)

dbus-daemon (PID: 5886, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gvfsd-fuse New Fork (PID: 5898, Parent: 3122)

fusermount (PID: 5898, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5899, Parent: 1)

rsyslogd (PID: 5899, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5903, Parent: 1)

dbus-daemon (PID: 5903, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5905, Parent: 1)

rsyslogd (PID: 5905, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5917, Parent: 1)

systemd-logind (PID: 5917, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5974, Parent: 1)

agetty (PID: 5974, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5975, Parent: 1400)

Default (PID: 5975, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5976, Parent: 1)

dbus-daemon (PID: 5976, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5977, Parent: 1)

agetty (PID: 5977, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5978, Parent: 1)

rsyslogd (PID: 5978, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5979, Parent: 1)

gpu-manager (PID: 5979, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5980, Parent: 5979)

sh (PID: 5980, Parent: 5979, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5981, Parent: 5980)

grep (PID: 5981, Parent: 5980, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5985, Parent: 5979)

sh (PID: 5985, Parent: 5979, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5986, Parent: 5985)

grep (PID: 5986, Parent: 5985, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5987, Parent: 5979)

sh (PID: 5987, Parent: 5979, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5988, Parent: 5987)

grep (PID: 5988, Parent: 5987, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5989, Parent: 5979)

sh (PID: 5989, Parent: 5979, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5990, Parent: 5989)

grep (PID: 5990, Parent: 5989, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6050, Parent: 5979)

sh (PID: 6050, Parent: 5979, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6051, Parent: 6050)

grep (PID: 6051, Parent: 6050, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6055, Parent: 5979)

sh (PID: 6055, Parent: 5979, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6056, Parent: 6055)

grep (PID: 6056, Parent: 6055, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6059, Parent: 5979)

sh (PID: 6059, Parent: 5979, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6062, Parent: 6059)

grep (PID: 6062, Parent: 6059, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6064, Parent: 5979)

sh (PID: 6064, Parent: 5979, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6065, Parent: 6064)

grep (PID: 6065, Parent: 6064, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5993, Parent: 1)

systemd-logind (PID: 5993, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6067, Parent: 1)

generate-config (PID: 6067, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6068, Parent: 6067)

pkill (PID: 6068, Parent: 6067, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6069, Parent: 1)

gdm-wait-for-drm (PID: 6069, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6074, Parent: 1)

gdm3 (PID: 6074, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6078, Parent: 6074)

plymouth (PID: 6078, Parent: 6074, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6101, Parent: 6074)

gdm-session-worker (PID: 6101, Parent: 6074, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6105, Parent: 6101)

gdm-wayland-session (PID: 6105, Parent: 6101, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6111, Parent: 6105)

dbus-run-session (PID: 6111, Parent: 6105, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6112, Parent: 6111)

dbus-daemon (PID: 6112, Parent: 6111, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 6116, Parent: 6112)

dbus-daemon New Fork (PID: 6117, Parent: 6116)

false (PID: 6117, Parent: 6116, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6119, Parent: 6112)

dbus-daemon New Fork (PID: 6120, Parent: 6119)

false (PID: 6120, Parent: 6119, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6121, Parent: 6112)

dbus-daemon New Fork (PID: 6122, Parent: 6121)

false (PID: 6122, Parent: 6121, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6123, Parent: 6112)

dbus-daemon New Fork (PID: 6124, Parent: 6123)

false (PID: 6124, Parent: 6123, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6125, Parent: 6112)

dbus-daemon New Fork (PID: 6126, Parent: 6125)

false (PID: 6126, Parent: 6125, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6127, Parent: 6112)

dbus-daemon New Fork (PID: 6128, Parent: 6127)

false (PID: 6128, Parent: 6127, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6130, Parent: 6112)

dbus-daemon New Fork (PID: 6131, Parent: 6130)

false (PID: 6131, Parent: 6130, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 6113, Parent: 6111)

gnome-session (PID: 6113, Parent: 6111, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 6113, Parent: 6111, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 6132, Parent: 6113)

session-migration (PID: 6132, Parent: 6113, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 6133, Parent: 6113)

sh (PID: 6133, Parent: 6113, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6133, Parent: 6113, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 6149, Parent: 6074)

gdm-session-worker (PID: 6149, Parent: 6074, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6154, Parent: 6149)

gdm-x-session (PID: 6154, Parent: 6149, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 6156, Parent: 6154)

Xorg (PID: 6156, Parent: 6154, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 6156, Parent: 6154, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 6156, Parent: 6154, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 6165, Parent: 6156)

sh (PID: 6165, Parent: 6156, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6166, Parent: 6165)

xkbcomp (PID: 6166, Parent: 6165, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6405, Parent: 6156)

sh (PID: 6405, Parent: 6156, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6406, Parent: 6405)

xkbcomp (PID: 6406, Parent: 6405, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 6169, Parent: 6154)

Default (PID: 6169, Parent: 6154, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 6170, Parent: 6154)

dbus-run-session (PID: 6170, Parent: 6154, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6171, Parent: 6170)

dbus-daemon (PID: 6171, Parent: 6170, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 6185, Parent: 6171)

dbus-daemon New Fork (PID: 6186, Parent: 6185)

at-spi-bus-launcher (PID: 6186, Parent: 6185, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 6191, Parent: 6186)

dbus-daemon (PID: 6191, Parent: 6186, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6566, Parent: 6191)

dbus-daemon New Fork (PID: 6567, Parent: 6566)

at-spi2-registryd (PID: 6567, Parent: 6566, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 6213, Parent: 6171)

dbus-daemon New Fork (PID: 6214, Parent: 6213)

false (PID: 6214, Parent: 6213, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6216, Parent: 6171)

dbus-daemon New Fork (PID: 6217, Parent: 6216)

false (PID: 6217, Parent: 6216, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6218, Parent: 6171)

dbus-daemon New Fork (PID: 6219, Parent: 6218)

false (PID: 6219, Parent: 6218, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6222, Parent: 6171)

dbus-daemon New Fork (PID: 6223, Parent: 6222)

false (PID: 6223, Parent: 6222, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6224, Parent: 6171)

dbus-daemon New Fork (PID: 6225, Parent: 6224)

false (PID: 6225, Parent: 6224, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6226, Parent: 6171)

dbus-daemon New Fork (PID: 6227, Parent: 6226)

false (PID: 6227, Parent: 6226, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6229, Parent: 6171)

dbus-daemon New Fork (PID: 6230, Parent: 6229)

false (PID: 6230, Parent: 6229, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6407, Parent: 6171)

dbus-daemon New Fork (PID: 6408, Parent: 6407)

ibus-portal (PID: 6408, Parent: 6407, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6582, Parent: 6171)

dbus-daemon New Fork (PID: 6583, Parent: 6582)

gjs (PID: 6583, Parent: 6582, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6794, Parent: 6171)

dbus-daemon New Fork (PID: 6795, Parent: 6794)

false (PID: 6795, Parent: 6794, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 6172, Parent: 6170)

gnome-session (PID: 6172, Parent: 6170, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 6172, Parent: 6170, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 6173, Parent: 6172)

gnome-session-check-accelerated (PID: 6173, Parent: 6172, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 6192, Parent: 6173)

gnome-session-check-accelerated-gl-helper (PID: 6192, Parent: 6173, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 6202, Parent: 6173)

gnome-session-check-accelerated-gles-helper (PID: 6202, Parent: 6173, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 6231, Parent: 6172)

session-migration (PID: 6231, Parent: 6172, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 6232, Parent: 6172)

sh (PID: 6232, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6232, Parent: 6172, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6397, Parent: 6232)

ibus-daemon (PID: 6397, Parent: 6232, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6401, Parent: 6397)

ibus-memconf (PID: 6401, Parent: 6397, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6403, Parent: 6397)

ibus-daemon New Fork (PID: 6404, Parent: 6403)

ibus-x11 (PID: 6404, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6626, Parent: 6397)

ibus-engine-simple (PID: 6626, Parent: 6397, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6599, Parent: 6172)

sh (PID: 6599, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6599, Parent: 6172, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6601, Parent: 6172)

sh (PID: 6601, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6601, Parent: 6172, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6603, Parent: 6172)

sh (PID: 6603, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6603, Parent: 6172, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6604, Parent: 6172)

sh (PID: 6604, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6604, Parent: 6172, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6605, Parent: 6172)

sh (PID: 6605, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6605, Parent: 6172, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6637, Parent: 6605)

gsd-print-notifications New Fork (PID: 6638, Parent: 6637)

gsd-printer (PID: 6638, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6607, Parent: 6172)

sh (PID: 6607, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6607, Parent: 6172, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6609, Parent: 6172)

sh (PID: 6609, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6609, Parent: 6172, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6610, Parent: 6172)

sh (PID: 6610, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6610, Parent: 6172, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6611, Parent: 6172)

sh (PID: 6611, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6611, Parent: 6172, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6614, Parent: 6172)

sh (PID: 6614, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6614, Parent: 6172, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6616, Parent: 6172)

sh (PID: 6616, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6616, Parent: 6172, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6620, Parent: 6172)

sh (PID: 6620, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6620, Parent: 6172, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6624, Parent: 6172)

sh (PID: 6624, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6624, Parent: 6172, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6625, Parent: 6172)

sh (PID: 6625, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6625, Parent: 6172, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6860, Parent: 6172)

sh (PID: 6860, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6860, Parent: 6172, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6911, Parent: 6172)

sh (PID: 6911, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6911, Parent: 6172, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 6150, Parent: 6074)

Default (PID: 6150, Parent: 6074, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6151, Parent: 6074)

Default (PID: 6151, Parent: 6074, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6080, Parent: 1)

accounts-daemon (PID: 6080, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6090, Parent: 6080)

language-validate (PID: 6090, Parent: 6080, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6091, Parent: 6090)

language-options (PID: 6091, Parent: 6090, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6092, Parent: 6091)

sh (PID: 6092, Parent: 6091, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6093, Parent: 6092)

locale (PID: 6093, Parent: 6092, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6094, Parent: 6092)

grep (PID: 6094, Parent: 6092, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6095, Parent: 1)

polkitd (PID: 6095, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6109, Parent: 1410)

dbus-daemon (PID: 6109, Parent: 1410, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6252, Parent: 1)

systemd-localed (PID: 6252, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6417, Parent: 1)

upowerd (PID: 6417, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6455, Parent: 1410)

pulseaudio (PID: 6455, Parent: 1410, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6458, Parent: 1)

geoclue (PID: 6458, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6564, Parent: 1)

rtkit-daemon (PID: 6564, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6576, Parent: 1)

wpa_supplicant (PID: 6576, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6577, Parent: 1)

avahi-daemon (PID: 6577, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6579, Parent: 6577)

systemd New Fork (PID: 6580, Parent: 1)

packagekitd (PID: 6580, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6606, Parent: 6580)

dpkg (PID: 6606, Parent: 6580, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6641, Parent: 1)

systemd-hostnamed (PID: 6641, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6832, Parent: 1)

colord (PID: 6832, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6909, Parent: 6832)

colord-sane (PID: 6909, Parent: 6832, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6863, Parent: 1)

ModemManager (PID: 6863, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6928, Parent: 1)

fprintd (PID: 6928, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

systemd New Fork (PID: 7034, Parent: 2935)

dbus-daemon (PID: 7034, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7035, Parent: 2935)

pulseaudio (PID: 7035, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ngwa5.elf

ReversingLabs: Detection: 34%

Source: /usr/bin/pkill (PID: 6068)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6156)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6173)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6192)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6202)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6232)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6455)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7035)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: ngwa5.elf

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: fingwi.cardiacpure.ru. [malformed]

Source: global traffic	TCP traffic: 192.168.2.13:51310 -> 178.215.238.112:33966
Source: global traffic	TCP traffic: 192.168.2.13:44762 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 5905)	Reads hosts file: /etc/hosts			Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5978)	Reads hosts file: /etc/hosts			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6074)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6112)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6113)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6156)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6171)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6191)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6172)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 6397)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: Xorg.0.log.160.dr, syslog.45.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.160.dr, syslog.45.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.45.dr, syslog.33.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5728, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5707, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5709, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5899, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5903, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5905, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5974, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6171)	SIGKILL sent: pid: 6185, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6171)	SIGKILL sent: pid: 6407, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6171)	SIGKILL sent: pid: 6582, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6191)	SIGKILL sent: pid: 6566, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5728, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5707, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5709, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5899, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5903, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5905, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 5726)	SIGKILL sent: pid: 5974, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6171)	SIGKILL sent: pid: 6185, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6171)	SIGKILL sent: pid: 6407, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6171)	SIGKILL sent: pid: 6582, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6191)	SIGKILL sent: pid: 6566, result: successful	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.evad.linELF@0/102@213/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5886)	File: /proc/5886/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5898)	File: /proc/5898/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5903)	File: /proc/5903/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5976)	File: /proc/5976/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6112)	File: /proc/6112/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6171)	File: /proc/6171/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6191)	File: /proc/6191/mounts	Jump to behavior
Source: /usr/bin/gjs (PID: 6583)	File: /proc/6583/mounts	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6232)	File: /proc/6232/mounts
Source: /usr/bin/dbus-daemon (PID: 6109)	File: /proc/6109/mounts
Source: /usr/bin/dbus-daemon (PID: 7034)	File: /proc/7034/mounts

Source: /usr/libexec/gsd-rfkill (PID: 5728)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5728)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5733)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5917)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5917)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5917)	File: /run/systemd/seats/.#seat0aZpG7D	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/seats/.#seat0uHHPSl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#12772BJDn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#1278rtIcm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/seats/.#seat0fzdyQn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127Lo3ZWl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c1G9uBkl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127XRSNNm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/seats/.#seat0lB2iUn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#12779wmDl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c1sfSDio	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c1GnGTxl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127P023jn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c1Y5uJFl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c1Zp7qbl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c1SFRedm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127mLY1an	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/seats/.#seat0bTNxfk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127WecNpn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/seats/.#seat04Gz6Wl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127fKWDRl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/seats/.#seat0B1VB5m	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127uyZ0Nm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c2hknv4l	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127H1u04k	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/seats/.#seat02LEPUo	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c2ejXnOn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c2Wg9gvn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/users/.#127x54eLk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c2RY1SIm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c2IZE5dl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c2XJjwtn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c2Cw9Gul	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/sessions/.#c2BMls3l	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/inhibit/.#1H9RXHk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/inhibit/.#2zEXLVl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/inhibit/.#34VAxil	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/inhibit/.#4Q5PsOo	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5993)	File: /run/systemd/inhibit/.#5rVLxwn	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6133)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6133)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6156)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6156)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6173)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6173)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6173)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6192)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6202)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6202)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6202)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6232)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6232)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 6232)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6232)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 6232)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 6232)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 6232)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6404)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6404)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6601)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6601)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6603)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6603)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6604)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6604)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6607)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6607)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6625)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6625)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6080)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6080)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6095)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6417)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6417)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6580)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6641)	Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6832)	Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6863)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6863)	Directory: <invalid fd (11)>/..

Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/238/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/238/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/239/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/239/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/241/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/241/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/5707/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/5707/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/5709/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/5709/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/5/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/5/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/247/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/247/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6068)	File opened: /proc/127/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5980)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5985)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5987)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5989)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6050)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6055)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6059)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6064)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6165)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6405)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6092)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5981)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5986)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5988)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5990)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6051)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6056)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6062)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6065)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6094)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6068)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5974)	Reads version info: /etc/issue			Jump to behavior
Source: /sbin/agetty (PID: 5977)	Reads version info: /etc/issue			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6074)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6074)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6080)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6080)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5905)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5905)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5978)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5978)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5979)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 6156)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/ngwa5.elf (PID: 5724)

File: /tmp/ngwa5.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5979)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6156)	Truncated file: /var/log/Xorg.pid-6156.log			Jump to behavior

Source: /usr/bin/pkill (PID: 6068)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6156)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6173)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6192)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6202)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6232)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6455)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7035)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/ngwa5.elf (PID: 5722)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5733)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5905)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5974)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5977)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5978)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5979)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6101)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6113)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6149)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 6154)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6156)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 6186)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 6567)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6172)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6173)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6192)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6202)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6232)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6404)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6601)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6603)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6604)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6609)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6611)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6625)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6455)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6577)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6580)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6641)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6909)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6928)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7035)	Queries kernel information via 'uname':

Source: ngwa5.elf, 5722.1.00007ffca7b22000.00007ffca7b43000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.ECMCmU
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.222] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.548] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.682] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.327] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.618] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.197] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.662] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.076] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:23 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) LoadModule: "vmware"
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.257] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.529] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.246] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.563] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): vis: 4
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.698] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.514] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.543] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.407] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.698] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.713] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.573] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.400] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.789] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.568] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.377] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.510] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.909] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.282] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.027] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.687] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.902] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: ngwa5.elf, 5722.1.00007ffca7b22000.00007ffca7b43000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.ECMCmU:u
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.422] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.519] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.748] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.411] (--) vmware(0): vis: 4
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.501] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.506] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.392] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:28 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.388] (--) vmware(0): bpp: 32
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.425] (==) vmware(0): RGB weight 888
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:23 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.153] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.505] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.366] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.652] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.490] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:24 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.758] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.657] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:28 galassia /usr/lib/gdm3/gdm-x-session[6156]: (==) vmware(0): Backing store enabled
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.646] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.526] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.351] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.652] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.672] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.820] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.229] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.212] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.036] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.302] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.604] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.688] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.761] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.865] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.972] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.961] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.160.dr	Binary or memory string: [ 186.821] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.983] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.613] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.779] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.217] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.168] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.129] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.733] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.511] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.608] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.180] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.160.dr	Binary or memory string: [ 188.982] (EE) vmware(0): Failed to open drm.
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.33.dr	Binary or memory string: Jan 6 17:48:53 galassia kernel: [ 156.260852] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.318] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 191.099] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.033] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.235] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.703] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.745] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.173] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.019] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.778] (==) vmware(0): DPI set to (96, 96)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.883] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.483] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.100] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.667] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.677] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.222] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.627] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.487] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.718] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 191.014] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.160.dr	Binary or memory string: [ 191.033] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.330] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.657] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.312] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.799] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.465] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.529] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 186.746] (II) LoadModule: "vmware"
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.773] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.620] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.583] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.631] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.431] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.768] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.365] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.835] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.232] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.570] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.178] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.804] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.047] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.723] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.465] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.950] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.552] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 191.094] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.160.dr	Binary or memory string: [ 187.005] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.587] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.071] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 187.152] (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.845] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.262] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.335] (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:28 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.977] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.361] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.683] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.756] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.028] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (WW) vmware(0): Disabling 3D support.
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.752] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.397] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.614] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.267] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.021] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.332] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.124] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.297] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.470] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 191.027] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.372] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.343] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.010] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.455] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.713] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.855] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.202] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.739] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.057] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.174] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.927] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.014] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.896] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.534] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.661] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.510] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.465] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.33.dr	Binary or memory string: Jan 6 17:48:53 galassia kernel: [ 156.260817] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse mptspi scsi_transport_spi ahci mptscsih libahci mptbase vmxnet3
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.784] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.471] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:23 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.622] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.322] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.431] (==) vmware(0): Default visual is TrueColor
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.593] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): vram: 4194304
Source: ngwa5.elf, 5722.1.00005592dcfa8000.00005592dd0d6000.rw-.sdmp, ngwa5.elf, 5726.1.00005592dcfa8000.00005592dd0d6000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.207] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.415] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.496] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.728] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.265] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.009] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): depth: 24
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.453] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.564] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.491] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.353] (--) vmware(0): bpp: 32
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: ngwa5.elf, 5722.1.00007ffca7b22000.00007ffca7b43000.rw-.sdmp, ngwa5.elf, 5726.1.00007ffca7b22000.00007ffca7b43000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.272] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.097] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.458] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.809] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.382] (--) vmware(0): depth: 24
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.573] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 188.992] (WW) vmware(0): Disabling 3D support.
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.643] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.551] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.609] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.995] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.081] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.086] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.168] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.337] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.439] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.581] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.523] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:28 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.693] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.183] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.402] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.593] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.955] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.525] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.794] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.763] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.317] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.632] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.091] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 186.764] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.889] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.734] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.637] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.252] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.324] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.598] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:28 galassia /usr/lib/gdm3/gdm-x-session[6156]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.000] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.113] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.637] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.520] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:24 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.451] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.677] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.442] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.480] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:28 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.382] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.672] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.118] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.148] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.258] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.765] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.814] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.916] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.158] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.728] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.850] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.708] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 188.998] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.134] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.197] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.603] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.723] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.718] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.277] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.860] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: ngwa5.elf, 5726.1.00007ffca7b22000.00007ffca7b43000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.359] (--) vmware(0): vram: 4194304
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.626] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.989] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.500] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.933] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.741] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.871] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.163] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.922] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.534] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.039] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.588] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.940] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.427] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.576] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.769] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.447] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.066] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.005] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.281] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.003] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.061] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.108] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.693] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.405] (--) vmware(0): w.blu: 8
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.475] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.558] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.160.dr	Binary or memory string: [ 186.714] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.412] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.227] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.477] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.052] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.553] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.287] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.774] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.825] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.395] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.387] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.578] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.188] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.876] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.347] (--) vmware(0): depth: 24
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.518] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.459] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.356] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.237] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.485] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.558] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.966] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.376] (--) vmware(0): mheig: 885
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.558] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.667] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.514] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.103] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.436] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.417] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.539] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.139] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.371] (--) vmware(0): mwidt: 1176
Source: ngwa5.elf, 5722.1.00005592dcfa8000.00005592dd0d6000.rw-.sdmp, ngwa5.elf, 5726.1.00005592dcfa8000.00005592dd0d6000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.703] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:23 galassia /usr/lib/gdm3/gdm-x-session[6156]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.025] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 194.471] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.307] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.394] (--) vmware(0): w.red: 8
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.495] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:26 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.160.dr	Binary or memory string: [ 189.599] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:31 galassia /usr/lib/gdm3/gdm-x-session[6156]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.460] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.160.dr	Binary or memory string: [ 190.548] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 6 17:49:27 galassia /usr/lib/gdm3/gdm-x-session[6156]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6080)

Logged in records file read: /var/log/wtmp

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ngwa5.elf	34%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.rsyslog.com	0%	Avira URL Cloud	safe
http://wiki.x.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	high
fingwi.cardiacpure.ru	178.215.238.112	true	false	high
fingwi.cardiacpure.ru. [malformed]	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.45.dr, syslog.33.dr	false	Avira URL Cloud: safe	unknown
http://wiki.x.org	Xorg.0.log.160.dr, syslog.45.dr	false	Avira URL Cloud: safe	unknown
http://www.ubuntu.com/support)	Xorg.0.log.160.dr, syslog.45.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.215.238.112	fingwi.cardiacpure.ru	Germany		10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
178.215.238.112	debvps.elf	Get hash	malicious	Unknown	Browse
	wev86.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Mirai	Browse
	jefne64.elf	Get hash	malicious	Mirai	Browse
	fqkjei686.elf	Get hash	malicious	Mirai	Browse
	vevhea4.elf	Get hash	malicious	Mirai	Browse
	debvps.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	debvps.elf	Get hash	malicious	Unknown	Browse
	wev86.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	jefne64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	fqkjei686.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	root.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	94.156.227.153-x86-2025-01-06T15_02_30.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
fingwi.cardiacpure.ru	debvps.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
fingwi.cardiacpure.ru	debvps.elf	Get hash	malicious	Mirai	Browse	178.215.238.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	debvps.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wev86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jefne64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fqkjei686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	debvps.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	wev86.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	arm7.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	arm.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	jefne64.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	fqkjei686.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	vevhea4.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	debvps.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.112

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6117/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6120/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6122/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6124/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6126/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6128/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6131/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6186/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6214/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6217/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6219/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6223/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6225/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6227/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6230/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6408/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6567/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6583/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6795/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:jSv:g
MD5:	07979E10BA486EA42E1AF2981FA92314
SHA1:	A464A7CAEBC9FD1A80E5A20D4413DEDA6F0BD94D
SHA-256:	E0EFD34290AAC96778CFA014321629421A2895E33153F12C6EC2362A52BAAEF1
SHA-512:	2560B7460EB1DBC3F35E8D248CDC6460524525C1FE0CEC7438553BC1C34ED927A7B684CD9D535E1020255F3A9529EEB7364D57299DA391765F51EC2B86CBAE28
Malicious:	false
Preview:	6577.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:wvn:wv
MD5:	566076D49B0299858193C552CA07DAC3
SHA1:	086EECA968FD252CC583632713554965BD24FD00
SHA-256:	5497DFC95933471EC4E1E37A28AC45A8B86954B4554AFA27C59C45B8E13F939A
SHA-512:	F1AEBF9F80C851A180B08F3FA4856E8081B261F36E188B53E340D79794EFDEA4897AA9C12A4053DADC30B4263571E1AC3D987DFB14050D0B8F5E99F941B5922B
Malicious:	false
Preview:	6074.

/run/systemd/inhibit/.#1H9RXHk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifFyeIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfvApLHK7wR9n
MD5:	4C48C6CE333B4BC4E4E0058C7BB1F35D
SHA1:	5300E3B1072B7C2BB5889E96EC8EAF1C55385271
SHA-256:	8C7B97BBA47AD316836416F1AA198CE1AA4B2D70A430525F3264FDC878F34D62
SHA-512:	B6EF4890876CF197A74963B9C8AF138668DA30FB1AE4830D24D30275B0ADAE5C5E1B971EC0B1E0116C2E0B87FB8C7A60D34BF40A67B1C17028C1E3D49457508B
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6417.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2zEXLVl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.195387072061649
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+SqKLXv0Rsz:qgFqXQXTI1IlLqKjcRsz
MD5:	7125BB32B613503C7AF3B63A1A344511
SHA1:	08C4FD118F9415452BD10BFBF9569DF7E7C7C41F
SHA-256:	1A02767255202D930A8414190411595E4D9A0640232F7B7D2BBB193D9F61C43E
SHA-512:	9D958C8D2C0CC25F00498E5639ECF2062412A6210AC1A6A376B2C167E9DEC17201E203BA3A9D43ACFFB2FB720AB49605143A175884A57D00847CB452653E0182
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6611.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#34VAxil

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.148187060462055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++TiXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+SqKLXv0RT
MD5:	4F8BCF86C4A51F6B640817A4238396C8
SHA1:	499500250232BE34C9BE6113CD072B8A6AA5503A
SHA-256:	99F399553B4A7404ADEECB213DDEC030144F0C608852C890CDD01C6329134B0C
SHA-512:	BA95407ECE297E5E7E00D894B686EEC0FD74D3D36767206006CD76387D1E8AD626ED2E6CB7800EEB065D9FD93C2A4AD87CBBC30CB65B7F8184DE7EC9C59AA0D5
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6611.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4Q5PsOo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.152041866447974
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++qYC3iXulpv5RX8/SflY:SbFuFyL8OAAx+dDlpLRS
MD5:	64FB5C725B46CD320B4F0761F8FBE0C1
SHA1:	16C10EFC82A0FD1FF7B4FD6F0EC5F311EDCDA709
SHA-256:	CE5CDA705F68631C4EB228DD130B531651EA3D7E37CB74578DC50AA93F946EBB
SHA-512:	3E8C3D5581D1EBF3793660A76D22BC9B61B7CF2FD5EE11CE2BAE86E6B377C18C4CAC372A1F536108F2C34B3508DA2C69C6C1DAF4AA3B32F3E3CC76AB9D45007A
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6625.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/inhibit/.#5rVLxwn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.974198609053518
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifCvDkBoDWicRF2Tg+tX8/Sf5:SbFuFyL8OAApfCvDjDJcjKR5
MD5:	659810F51A7A5A405491A31EA310F86D
SHA1:	FD994FD509C8E530122921278A70F52626E2EA13
SHA-256:	47134B71E204BFD0142764E729AA9A218B034D421C05B3B620AE6B4BB2599238
SHA-512:	4F0B800C1C34A712F171BBE01EC8856AE4BE0346DE1ABE91BE9EBEB2329811207D4CF9EC6D686124D0DA5F17041EFA986F41D81C75031C7EDBA457F897A99BAB
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6863.WHO=ModemManager.WHY=ModemManager needs to reset devices.FIFO=/run/systemd/inhibit/5.ref.

/run/systemd/seats/.#seat02LEPUo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat04Gz6Wl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0B1VB5m

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0aZpG7D

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0bTNxfk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0fzdyQn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0lB2iUn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0uHHPSl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/sessions/.#c1G9uBkl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.495737676960471
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffG8xfx2xNIByy6GB8UvQCgD2qFz:qgFqPuFVuRZI4Be89x2xayW81CgDjZ
MD5:	6CFEDD6E8C0092A7DCF80ACA57F05283
SHA1:	C4D13C5A24D64C8EE3DE85BD14F5A42D688461F0
SHA-256:	247346DCF2CFD466333CD8DBB95B6B76044BE6007D288708F1BE183FCA1F9A0E
SHA-512:	17C8D1172F1609637B5AD96C81F18816D298D12AEECD952D4F208DB45EDB3BAAEEDDED7B165FDFAE509B670A38A08E487B14492C011052F8E090B37163279D8B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8304.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6101.REALTIME=1736207355086982.MONOTONIC=177982420.

/run/systemd/sessions/.#c1GnGTxl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.432468252502833
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB8UvQCgD2qFz:qgFqPuFN6IG0n99x2xayW81CgDjZ
MD5:	6DDE2FE65196E8FB655A762CB588CD0A
SHA1:	835CF758C56B07127B49487B79439FEDBB55DB49
SHA-256:	79512470615B57E50C5BC67EF46E64BCA9829445DF82056F2F0AE66377F33D2E
SHA-512:	B0E66E805C6AC3944C9FFB3863F8511EBF6DA7FF4058DFDAB6F7C7CC2B34CEFACE1DC07290664F5A07049ECD1D4AB798785FCDEF17C7DA5B4F3ACB912B09CEBE
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6101.REALTIME=1736207355086982.MONOTONIC=177982420.

/run/systemd/sessions/.#c1SFRedm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.390372524509762
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GB8UvQCgD2qFz:qgFqPuFdDJIi9x2xayW81CgDjZ
MD5:	8B9C8C58E669E1A1E908321D9047C706
SHA1:	EB9A465322760F5D56957E146F15595EA42C4200
SHA-256:	B4E2D32CABBBDFDC128544D728036A3E47AB56ABA2BC5A564F7512000821BFC7
SHA-512:	1AF7CF14576D3DD4FDA11BCE553A7FC4C0A572F82A56FE51DF41B57BF459BE313D4CAC95A840E6000244BAD70B05CF4F652DD8AC070C8CF9F41B0041F287C921
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6101.REALTIME=1736207355086982.MONOTONIC=177982420.

/run/systemd/sessions/.#c1Y5uJFl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.436190377545199
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB8UvQCgD2qFrd:qgFqPuFN6IG0n99x2xayW81CgDjNd
MD5:	389EDFEA757898BD2336B7285CB50AD0
SHA1:	BBA874A3789D4034E3A81528CB906DD51F97DEAF
SHA-256:	58E93EABE0C3BA05D6A6333BC7ACA6357A0D1761AA3393DD2A19FB52848796D4
SHA-512:	C35F675E2715308344A0E0D60C581E0836DFFBE53790CBBDE70D5F8E1B03A5AD159720D073E1DDCE445C99AEA5F98A99B64F55A80A785A7B75B321329A2D24EC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6101.REALTIME=1736207355086982.MONOTONIC=177982420.CONTROLLER=:1.11.

/run/systemd/sessions/.#c1Zp7qbl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.432468252502833
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB8UvQCgD2qFz:qgFqPuFN6IG0n99x2xayW81CgDjZ
MD5:	6DDE2FE65196E8FB655A762CB588CD0A
SHA1:	835CF758C56B07127B49487B79439FEDBB55DB49
SHA-256:	79512470615B57E50C5BC67EF46E64BCA9829445DF82056F2F0AE66377F33D2E
SHA-512:	B0E66E805C6AC3944C9FFB3863F8511EBF6DA7FF4058DFDAB6F7C7CC2B34CEFACE1DC07290664F5A07049ECD1D4AB798785FCDEF17C7DA5B4F3ACB912B09CEBE
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6101.REALTIME=1736207355086982.MONOTONIC=177982420.

/run/systemd/sessions/.#c1sfSDio

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.432468252502833
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB8UvQCgD2qFz:qgFqPuFN6IG0n99x2xayW81CgDjZ
MD5:	6DDE2FE65196E8FB655A762CB588CD0A
SHA1:	835CF758C56B07127B49487B79439FEDBB55DB49
SHA-256:	79512470615B57E50C5BC67EF46E64BCA9829445DF82056F2F0AE66377F33D2E
SHA-512:	B0E66E805C6AC3944C9FFB3863F8511EBF6DA7FF4058DFDAB6F7C7CC2B34CEFACE1DC07290664F5A07049ECD1D4AB798785FCDEF17C7DA5B4F3ACB912B09CEBE
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6101.REALTIME=1736207355086982.MONOTONIC=177982420.

/run/systemd/sessions/.#c2BMls3l

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.4471203970399715
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB4czgDRmGk:qgFqPuFNuCH0nI9x2xayW40gDRmGk
MD5:	99C08B08F4DCFBE4930C6A2EF94D6ED7
SHA1:	F58827A0424AEBECF2AE4FB2AAD164FAA2C280DA
SHA-256:	B038C4E5FB083912BEBE85C5F60D14E9EE047A802C368F92D481A7D3CA809326
SHA-512:	DEC338C247D292DFCBC7DED565AD33F1A5880734112286B74ACF346E3A44D558A248F9CDE9F597990173A1A796786EDED327CFCCD8B045136642592627C406CC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6149.REALTIME=1736207361625794.MONOTONIC=184521232.CONTROLLER=:1.15.DEVICES=13:66 13:65 13:67 13:64 .

/run/systemd/sessions/.#c2Cw9Gul

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.447162838477597
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB4czgDRmAk:qgFqPuFNuCH0nI9x2xayW40gDRmAk
MD5:	DD45B5ECB7131DF287D758E5A0D00910
SHA1:	57A26FB59C536C8210ED3E367CC23DEA37CF1715
SHA-256:	C20802E4294C444818E86313D614D6C71581750E9560691F4AF85EF827FB39BF
SHA-512:	37AACCA4A016E7AC89626AA1A9D694EA0BC43B74E35421C588318D3D8D456EA2663B01FDFC3C887F813443F3DCAA0355CF492DC7C333CCCFFEB00F167A50D567
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6149.REALTIME=1736207361625794.MONOTONIC=184521232.CONTROLLER=:1.15.DEVICES=13:65 13:67 13:64 .

/run/systemd/sessions/.#c2IZE5dl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.432559679667283
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB4czgDRmz:qgFqPuFNuCH0nI9x2xayW40gDRmz
MD5:	D2BD95527EE6E9AA3170FA7628FC6EC7
SHA1:	368AB947997A72ABE588A7D33570F848C7D860CA
SHA-256:	45FF6A08530595D2E9EBD2A3F61D048B6231AD6D8BC33BB9E3CD7CCF78CA85AC
SHA-512:	79E9FDA06B5D7A52E2BFE24A4ABF13EDD19A47EC85F48BC5BFFFAEA91B058CF5575B9303783C5135565277831BA9745D1CF2A4D070128F238E8D7B64FB5243EA
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6149.REALTIME=1736207361625794.MONOTONIC=184521232.CONTROLLER=:1.15.DEVICES=13:64 .

/run/systemd/sessions/.#c2RY1SIm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.429415409342996
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB4czgDRmB:qgFqPuFNuCH0nI9x2xayW40gDRmB
MD5:	514286C59C50ECB4F26909E133C64E5B
SHA1:	23DDE53A20A4933BA836EFB4E19508410F6C806E
SHA-256:	3F7350E18FF87A4AF379DF3AFC0231B7EE32FC442436ACF3E8FAC2A836882179
SHA-512:	01267E45395156DDAABA10D0FB668DDAF8AB79C608DB836DB1C35F962614B851FE772DF56941A1601D6365D68C55136A4A18B2727DCEC58128E6ECBAE1419E41
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6149.REALTIME=1736207361625794.MONOTONIC=184521232.CONTROLLER=:1.15.

/run/systemd/sessions/.#c2Wg9gvn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.419253679581044
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB4czgDRk:qgFqPuFNuCH0nI9x2xayW40gDRk
MD5:	A783226B3C625B17182D5E28018837CF
SHA1:	078CE8441B85035D64B8BE5B18D53BED99D76574
SHA-256:	9196C199D82FE80BD2A7FEB0D6F687084AE53E109E2EFEB181E8F2EA8EDB2AFF
SHA-512:	39272275DE501CAB85D9F1DBEFE02479F274F1E38BAA08D722127F6AFC40E5708773F9F57BD3C43512CF30B53F9448BE93C9807C230F717492FB6682846FBF72
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6149.REALTIME=1736207361625794.MONOTONIC=184521232.

/run/systemd/sessions/.#c2XJjwtn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.44208518952876
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB4czgDRm6n:qgFqPuFNuCH0nI9x2xayW40gDRm6
MD5:	E9BA4BE125D6FCA9D6483B4BEFB0FC93
SHA1:	82BDCE5D584B22BB293FCA3FFE631EA600CE7A5C
SHA-256:	BD3FCB56917AEB9C3B61E1003362DBB6990E0F03AD8E3BE25EB5A1D0E48AF6AE
SHA-512:	C5BDD2FFEECAF0ACF5AD2C6BA93C6CC5CD66667F0D9EBCAC8564DD2DFF4EB3B778FC653EAC776D39F0B992562B6B5FDCCA9EC05BC8D08414FC27B98E91F6209B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6149.REALTIME=1736207361625794.MONOTONIC=184521232.CONTROLLER=:1.15.DEVICES=13:64 13:65 .

/run/systemd/sessions/.#c2ejXnOn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.419253679581044
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GB4czgDRk:qgFqPuFNuCH0nI9x2xayW40gDRk
MD5:	A783226B3C625B17182D5E28018837CF
SHA1:	078CE8441B85035D64B8BE5B18D53BED99D76574
SHA-256:	9196C199D82FE80BD2A7FEB0D6F687084AE53E109E2EFEB181E8F2EA8EDB2AFF
SHA-512:	39272275DE501CAB85D9F1DBEFE02479F274F1E38BAA08D722127F6AFC40E5708773F9F57BD3C43512CF30B53F9448BE93C9807C230F717492FB6682846FBF72
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6149.REALTIME=1736207361625794.MONOTONIC=184521232.

/run/systemd/sessions/.#c2hknv4l

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.47974884749176
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffSHxfx2xNIByy6GB4czgDRk:qgFqPuFVuRpCvBe9x2xayW40gDRk
MD5:	E8EAC74A9C8B66233D08A40505A85927
SHA1:	B21D7F22AD9D7911953724C5EB1FD87C8EDA6B1E
SHA-256:	CF2810C2F87E68F38CA54161F086D0D5249D848BE889F38C79F499C5BAB2201D
SHA-512:	5E4749E095FEC6216FE7E09D85CECCD70DAA30910CC57A9881A38D610F7FB6DB031463A56BC5710117618CF734A07EFA5023481403D89B8E089D61EFFC52A187
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8367.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6149.REALTIME=1736207361625794.MONOTONIC=184521232.

/run/systemd/users/.#12772BJDn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#12779wmDl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.155915849215661
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgDoD4gt2thQc2x9sS02/g2owB:qgFq30z1cL/ixegD04jthQHxbPYA
MD5:	05BAED26C30EFB24462DF36F45D60668
SHA1:	AEA70870369EDBEEDE11221BA78A996AD427A7AF
SHA-256:	B43926CC4DAE50A88554DA22326F8298D51D9A25897F137949CF6232D29D01DF
SHA-512:	3676C6A2D0568569F95B5AF9B95DD0DD88264CB9065C8A84140F521CE4FE9EA9F8CFA363854B0B52FF7BABECCEA57689DD0364083D982447DD4360BFABEAF45D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1278rtIcm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.302469157776451
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffTgDoD4gt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBLgD04jthQHtPYq9M
MD5:	C7FCCB61F121B2207834503FC943B166
SHA1:	60EDB40D9DBDAAF047A80B0FFABE0C665269B90B
SHA-256:	CF326665EB558D0147749610806C3BF81AD1A72EA76167CDB577417079DAE05A
SHA-512:	C8CBA9BDA7EC52C0F4B910C8072D5D5D61ED62464F6AA33A6EBEBB6249888B2E863586CED732A37F6A366855EC938F7C3D97B8BBBD01BC59593B5C486E0F1D41
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8242.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127H1u04k

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.165837064337864
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgDoD4gt2z5c2zw02zb2owB:qgFq30z1cL/ixxTgD04jz5HzwPzbA
MD5:	D2C1775C5D534A462C3D1E6915308B70
SHA1:	6587E3E2DEB13A44797727BE669C2C5F7B16A914
SHA-256:	63B52F617FD01FA7A8784EE3B70098D1D02006739109D323671F643C438E4D0E
SHA-512:	3A829BA40926CC25582AD0AD5CAD87E98F257731CC75512791E51A3DFDE1AEB53F0E994BA1068C5EB00765B095E01B2828AAEDB3905CD9DB16B2AA72B1FF23CE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Lo3ZWl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.307051202981211
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffTgDoD4gt2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBLgD04jthQHxbPYA
MD5:	93225A89392B711F2529AA7FBDC95BA5
SHA1:	D0EA787DD2386395BC8B530EC2A030310F197593
SHA-256:	C770D2581CCEAC9E450154AF79044901FC33E982498B00FE7A96EDCFAD203BF2
SHA-512:	0D4639BFE6838B109D390DBA4FD3C4284B9B89B67E10BEF8CF4EC5AE2C82CC525610781409CD9523C1873B4FCA353C9F7D5BA5C2FC1765561C0AFD10A162DC9C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8242.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127P023jn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.13997959423558
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgDoD4gt2thQc2x9sS02/g2owB:qgFq30NzL/ixegD04jthQHxbPYA
MD5:	66F214608E338991A5A90AC9EE5F7F5A
SHA1:	C4ED3C8C0505C432EA46275414B9BD372D210314
SHA-256:	AF17148521899568183EF34CB8CC17B88C9F2E6D6BA5A426DA6EFB61CA8EF4C4
SHA-512:	6C737ACDFBE656115E5F315D85F38943332332E43524B9E0F7404994F8EFF09511ED4EB139A603C54E65680C9B847F1A4EB64C80B617DDFCDA2F7518A06BAF41
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127WecNpn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.141968981545254
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDoD4gt2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegD04jthQHtPnmDq9x
MD5:	E319143AD7EAB66C04FE551A7704412D
SHA1:	861556F9529A7C3EAD276F87E72DCFAD53E8DE93
SHA-256:	DADF794BCEEC9CE2418B71218269BA92593FDFA21AA50C316EE6DC17BA609492
SHA-512:	16E394CC79D7315FE1291A25A459D1C0F5120CD6079D79077228FB429BA836978C8045F212784E2B6F56A8E8E6930316CEBF025770515D7B076B15C3CE5418DC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127XRSNNm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.3267974764130335
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffPYfgDoD4gt2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBYgD04jthQHxbPYA
MD5:	4B32C2B34C41C18ECEA4F57F471FB6AE
SHA1:	8F8A1D4D7BCDA6B65EC830CB015B748905480DAD
SHA-256:	2FA6555EC27443532B4D12C7062314512F8017A4BB094C8B290EC97E339C02A2
SHA-512:	07B51BD9F99852937AF2D7EE52C67EE0FB79023D3F8F8106378BCB583299731F722D0D14D0A7B6D6A72A4999DC0BA28DA0F7ADA772AB9C9B99EE41015530ABB1
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8242.DISPLAY=c1.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127fKWDRl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.141968981545254
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDoD4gt2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegD04jthQHtPnmDq9x
MD5:	E319143AD7EAB66C04FE551A7704412D
SHA1:	861556F9529A7C3EAD276F87E72DCFAD53E8DE93
SHA-256:	DADF794BCEEC9CE2418B71218269BA92593FDFA21AA50C316EE6DC17BA609492
SHA-512:	16E394CC79D7315FE1291A25A459D1C0F5120CD6079D79077228FB429BA836978C8045F212784E2B6F56A8E8E6930316CEBF025770515D7B076B15C3CE5418DC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127mLY1an

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.15675602294498
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDoD4gt2thQc2x9sS02nmD2owC:qgFq30dAL/ixegD04jthQHxbPnmDd
MD5:	CC91BEB8E3530A6C85828E20C58DC9EC
SHA1:	0BA11332FAD8BE3CC0E8D268853A913AA5A266AE
SHA-256:	67E738E787E42F93C8A1CC06D2261E8FDA758C96CC77B001EC33868E7368FF55
SHA-512:	99AACB8AC125EFBA43EFBE1B1B0B438A6B3010C6DE0D14B0EDEB6B26556EA8BFF2B95ED729D6CBDF18E73690A9676BC1892EECDA9CD8C37A5BDA6E9D033647A8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127uyZ0Nm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.142272129909648
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgDoD4gt2z5c2zw02zb2owB:qgFq30z1cL/iRJgD04jz5HzwPzbA
MD5:	F9F6D98703F071088C2C4889B1BB2498
SHA1:	630A5C7AB9C8F9D9A79E6E2E30E619732E62CB41
SHA-256:	BB2B69E6B8143BA0280E30DB95F95D29CA81E4E2AC61ADA0E1903524F2421272
SHA-512:	4EE49271FD4956BF96472BC782D053759AF469F0C22579E3BED1134BBCF26AFAFB9F4900A4D079287FE5FDAA4166AE898EAE617E001695008FF2A7768F1BEC86
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127x54eLk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.149900809357783
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgDoD4gt2z5c2zw02zb2owB:qgFq30NzL/ixxTgD04jz5HzwPzbA
MD5:	15C190764835400AE23E7D738DABF9FA
SHA1:	F81E45C4C52517F1078BE9E16A1AF456D296E5A2
SHA-256:	DFFA7EA36E3378103342A6B488D10DEECAE2981BAFF5138D342EE2AF696259CA
SHA-512:	6191147B940EF54306AE7E747D97F81D4166354DC007BC59CF8DA8FA6DB9B0086E6C2E22F18BAFF34FECF74C195B12DFD785166E0FD7A29595227ECA49C81FF2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1736207355076355.MONOTONIC=177971794.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mWQv:mWQv
MD5:	7DC4A7CC86CAFCF312B0D56C42F83151
SHA1:	AADAB93FD7239399FB31AEA1B20802333FA1B999
SHA-256:	205630253BA3FD1883F61B98002EFE5C7B5A113795774071CA89FF44CA4EBC63
SHA-512:	62B52822C6294D7C1AFED15270CBE852450FBFBA6D8E043DF6FAF0BE62AE3F7E8EAEE2B578E2BDC41818E0D233A211042C3892FC810140633B4E2F266B28796B
Malicious:	false
Preview:	7035.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.986717597969728
Encrypted:	false
SSDEEP:	12:OxPrYU2WaRveY+rYzExP/1veY+/yg4xPH+rl9NOveY+H+5AxPu3o3ulveY+u3o3A:cbDaK6WyetbFZxiPlZOo0/ic
MD5:	5C5FAB4932AA0E71259427DED41D71BA
SHA1:	49B111C1FD57963014AC8AAF233A8E6DD1799ECA
SHA-256:	B9214C405CA800E49FFB7EBD34E12F26FFA2990D12BF095045C0F1613C25A84E
SHA-512:	1BD197D18D4C61F135FCC755A348400EB1F89CB6BE7D618C7D775173E97D7774F0134C65C7FDBBBE3787577E751A0BCF82C6B30809B9CB0C8203E9944D927A01
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/6172..MIT-MAGIC-COOKIE-1.....;>...:?n.[...XSMP...#local/galassia:@/tmp/.ICE-unix/6172..MIT-MAGIC-COOKIE-1....j..*...1?g]z....ICE...!unix/galassia:/tmp/.ICE-unix/6113..MIT-MAGIC-COOKIE-1...,TC...M2k..f....ICE...#local/galassia:@/tmp/.ICE-unix/6113..MIT-MAGIC-COOKIE-1...<.$.a.:.z...2}...XSMP...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....3.16G.\|.Q.......XSMP...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..uoT..;.......%....ICE...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...)....I...b....L..ICE...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1..j...w~q]$M....<...XSMP...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...i...........LE..XSMP...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...e.....-..3$....ICE...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....<..;..6<L.......ICE...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..ad.U~.OxR.c.}..(..XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.920888777625093
Encrypted:	false
SSDEEP:	3:rg/WFllasO93zkrDhgWFllasO93zkrU:rg/WFl2jkrDOWFl2jkrU
MD5:	F96E96676B2A6CC83AF30B8219A508B4
SHA1:	2A5CD9CBDE3E95298147B9F9F5803034A940CA79
SHA-256:	17EA322F52A7B168E66A7B71E970EBCD9678B8C55E759E566423474E5A558555
SHA-512:	34207B12DE541DD378AAF36ED86BBB5A5B15F1C61B1A4E5AA055331E6A95BEE08657D85C6B4F37DE33E2CB5A572C99FD955988EBFA5C578352559F6341D913DD
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1.....=...Iv..=/Y......galassia....MIT-MAGIC-COOKIE-1.....=...Iv..=/Y..

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:T:T
MD5:	B2A9E464D4BA09AA6C1A59D44E7AFFBB
SHA1:	15D171632139B5A8EC8C830F1B03D06CC95A9A93
SHA-256:	78D22D016DBEC1300C385694EB257DED2F63DD92488A4B86CB0FDCA520D99447
SHA-512:	185EA2C46678957470F679DFBA4373DDDB67B88056C37A254CF8690B951AA700DB2F42FD329F2A723224E742E75FE9770251431A1059D1134E37BBBDEBEEA225
Malicious:	false
Preview:	6455.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:hc1sXlXEWtl//jJmlll:hv+ylHjJSl
MD5:	812F911812B7750888BE6C8B750B170B
SHA1:	38BA74A85CB0CF6AA76A4DE15EA8DCF91982B327
SHA-256:	CFDFC512838E97A61B09AEC269E825794E2CCA57E983CDBA5E53DF7AF52B5D27
SHA-512:	94991E0EC1BE2E8BAB9C10E74AA87AE96E2DB674F0CE0A0574958632EDCF9406745FEF7EA59899A42A541A5A8600691CDAD105B6EE089063A3F3576103F6B8AF
Malicious:	false
Preview:	....Y...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................Y....k\|g=.......................................

/tmp/qemu-open.ECMCmU (deleted)

Download File

Process:	/tmp/ngwa5.elf
File Type:	data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.0536606896881855
Encrypted:	false
SSDEEP:	3:TgOQLc8HJN:TgZJN
MD5:	AC250E3F00CC16907E0D589F2DC53826
SHA1:	C3458BAC504BEC0C4984AC81CB405E3FA8A96257
SHA-256:	9A16E706CBABA4731AF89B10A86B099D0F4FDD20140FBEEBFB27AFF963B03953
SHA-512:	CE0732E2BD36BEAE0158C7BEB599F222C0ACB3618BE2EC3EA7C32E17AE258CCD0E1626CA5DACA727C64EC060FFB3F20274F94929AE0D2D239981F7C168BE2797
Malicious:	false
Preview:	/tmp/ngwa5.elf.nwlrbbmqbh

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.L2NJZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.X5XRZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.158705011747534
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWW9IS19sn:q5sU3LWfLUDmQymqSFbfomSzISfsn
MD5:	937154638F8EE6297CC37BC74E737F67
SHA1:	2763902F004F5074B2B73C7C6D114843E12CB658
SHA-256:	731BB8A1ACCD3C4E293AE1A26266EFFA4343CFC5C4F6C5C1F59DD6E53726366E
SHA-512:	CE4027E7B2671D07A44DEF663928D24DB38F1B98DE2DFBA477CB333ABC012BA3965CC7E90D2B427B66C16300836CE74E7BC35E998987599E51E2F59AC17BFA45
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-6RvyW9Xj,guid=d838f336551b8dfe9e6824a2677c6c1b.IBUS_DAEMON_PID=6397.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.2864186101368125
Encrypted:	false
SSDEEP:	384:WRXHMEABCZMUdbdpdedSdBdsdTdWdddJd1dpdid/dpdodTd3dRdudaKdJDddOdqG:IXMpplTYWyX8x5V66Vy4U
MD5:	C526C4BFA5BD8DF454E343B76FE9E80E
SHA1:	12CD1C42CDB8DC6A0A3315A49A22AC7E919E364F
SHA-256:	19A59C02BD3D7E3FABE2FF4C5B6EC47DE569A09838E7842A6E0B26021AC57850
SHA-512:	8544CF97AA01C9E54F5068DAF54EB96637AE035516E97E52403E7488ED21E9BF49928B5B951D29CB787EFFDD8BCF413224F762F07CC6D3E1F2173ED2DE1E97B3
Malicious:	false
Preview:	[ 185.207] (--) Log file renamed from "/var/log/Xorg.pid-6156.log" to "/var/log/Xorg.0.log".[ 185.222] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 185.232] Build Operating System: linux Ubuntu.[ 185.240] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 185.255] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 185.271] Build Date: 06 July 2021 10:17:51AM.[ 185.277] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 185.282] Current version of pixman: 0.38.4.[ 185.288] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 185.292] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2133
Entropy (8bit):	5.015261812062565
Encrypted:	false
SSDEEP:	24:XZedGZ4I4ZAWNAvKA2+VcL7gFd2ArdcXju3Nu5TcrboQd8crCQkcrCQU:JvbfVFpkFpcrboXcrCBcrCn
MD5:	A6F8C269CC2D5049283E9C28B7ED6993
SHA1:	BC369326D885F30BBA3A4BEB54942A3E45FD7A83
SHA-256:	58AC545A1C3A4365A8F0641107C4DD440662A0B0A2E0E8A016995A0D49FF0CDB
SHA-512:	7B5BCB188B345AC5E446EE05F2B46DBAE502924C81C574757EA6EDA1D548C0134A139B438D676E4CA540BD0825DED2C46278DD92FAD4B50026E661C3ED750928
Malicious:	false
Preview:	Jan 6 17:48:58 galassia systemd-logind[5993]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 6 17:48:58 galassia systemd-logind[5993]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 6 17:48:58 galassia systemd-logind[5993]: User enumeration failed: Invalid argument.Jan 6 17:48:58 galassia systemd-logind[5993]: User of session 2 not known..Jan 6 17:48:58 galassia systemd-logind[5993]: Session enumeration failed: No such file or directory.Jan 6 17:48:58 galassia systemd-logind[5993]: Watching system buttons on /dev/input/event0 (Power Button).Jan 6 17:48:58 galassia systemd-logind[5993]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jan 6 17:48:58 galassia systemd-logind[5993]: New seat seat0..Jan 6 17:49:15 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 6 17:49:15 galassia systemd-logind[5993]: New session c1 of user gdm..Jan 6 17:49

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	42198
Entropy (8bit):	4.677487390703045
Encrypted:	false
SSDEEP:	384:U0JvbWu5/LDdyQZbzYNZmpFJauM2F8GjKh9RmmPSX9fLrQ2+o:U0WqQ9R0vz
MD5:	A1397BEB1E24AD4B50F8730418282BEF
SHA1:	23BC921BB6C32F6A0B8417DA044AF682BC18EF40
SHA-256:	2696BC7B1E7C9A412C0AAC7E1ECB9AAEDBF7D8C083096FF59595055A27EFFE21
SHA-512:	B01C40CFCE3958D6EB70575434400B0EBC95B44F96F78C10A6D487D1FC55C9EC52AE6B8A2C8579086B4A1095EF83DB50F14D40151C9974A2A63AA4AE10208407
Malicious:	false
Preview:	Jan 6 17:48:56 galassia kernel: [ 158.932493] blocking signal 9: 5726 -> 3132.Jan 6 17:48:56 galassia kernel: [ 159.504550] New task spawned: old: (tgid 5979, tid 5979), new (tgid: 5980, tid: 5980).Jan 6 17:48:56 galassia kernel: [ 159.567712] New task spawned: old: (tgid 5980, tid 5980), new (tgid: 5981, tid: 5981).Jan 6 17:48:56 galassia kernel: [ 159.683873] New task spawned: old: (tgid 5978, tid 5978), new (tgid: 5978, tid: 5982).Jan 6 17:48:56 galassia kernel: [ 159.684731] New task spawned: old: (tgid 5978, tid 5978), new (tgid: 5978, tid: 5983).Jan 6 17:48:56 galassia kernel: [ 159.689644] New task spawned: old: (tgid 5978, tid 5982), new (tgid: 5978, tid: 5984).Jan 6 17:48:56 galassia kernel: [ 159.840089] New task spawned: old: (tgid 5979, tid 5979), new (tgid: 5985, tid: 5985).Jan 6 17:48:56 galassia kernel: [ 159.889179] New task spawned: old: (tgid 5985, tid 5985), new (tgid: 5986, tid: 5986).Jan 6 17:48:56 galassia kernel: [ 160.197828] New task spawned:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	155794
Entropy (8bit):	5.1905059530765145
Encrypted:	false
SSDEEP:	768:KC2uvI/gY2fS1oGW/FDFOUGx09R0rrgmoY937+d1R:bvI/gfS5CFgUG69R4YR
MD5:	613989ABAD4E4CEAB7EF25B37A405320
SHA1:	808BECDC70F7679658C5AC9F1A4EB1C9FA41DA19
SHA-256:	87519BE1AB48F9EAA225C7DF11CCE3DFF5F552DB2EA1431903027EBFEBFEE673
SHA-512:	D69A442706E453231755448D0AF414058253FA31E788E980B06D51AE443504498EF0809F896FD45CDD35B47C71CE512E293434E8D2E5DF97B298F13B78B48C25
Malicious:	false
Preview:	Jan 6 17:48:55 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 6 17:48:55 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 6 17:48:55 galassia systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Jan 6 17:48:55 galassia systemd[1]: dbus.service: Failed with result 'signal'..Jan 6 17:48:55 galassia systemd[1]: Started D-Bus System Message Bus..Jan 6 17:48:55 galassia systemd[1]: getty@tty2.service: Succeeded..Jan 6 17:48:55 galassia systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 1..Jan 6 17:48:55 galassia systemd[1]: Stopped Getty on tty2..Jan 6 17:48:55 galassia systemd[1]: Started Getty on tty2..Jan 6 17:48:55 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 3..Jan 6 17:48:55 galassia systemd[1]: Stopped System Logging Service..Jan 6 17:48:55 galassia systemd[1]: Starting System Logging Service....Jan 6 17:48:56 galassia syst

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:hc1sXlXEWtl//jJmlll:hv+ylHjJSl
MD5:	812F911812B7750888BE6C8B750B170B
SHA1:	38BA74A85CB0CF6AA76A4DE15EA8DCF91982B327
SHA-256:	CFDFC512838E97A61B09AEC269E825794E2CCA57E983CDBA5E53DF7AF52B5D27
SHA-512:	94991E0EC1BE2E8BAB9C10E74AA87AE96E2DB674F0CE0A0574958632EDCF9406745FEF7EA59899A42A541A5A8600691CDAD105B6EE089063A3F3576103F6B8AF
Malicious:	true
Preview:	....Y...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................Y....k\|g=.......................................

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.509216331992099
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ngwa5.elf
File size:	142'080 bytes
MD5:	86553d36841e35d034d3798a7d96537f
SHA1:	fe90d24f9237c911b14836991fa0241e781bd0c4
SHA256:	26a24796548c4054f85669c3d83b79f07653baf63aeeee9a5058eed6a07b6c94
SHA512:	63e91b909ccf82d06861341bf5b44d341777e4818d66664abef2f18d63b0de06b22e1413d01ca4dc87e9b7842cd2e588d25f6174835bc25f0c3a4569297bcba2
SSDEEP:	1536:I9ApxSazhQBHN/dutr2W8g4VKlhTO4tE+GROXbQSxWjg81lcNwywc2GfFJRbPDhR:I932metr/46ha4t1Y+WctyL+c
TLSH:	0CD31985F9819F13C6C612BBFB5E428D772A1768D3EE32039D256F25378685B0E37242
File Content Preview:	.ELF...a..........(.........4...p)......4. ...(.....................\|...\|...........................0I..............Q.td..................................-...L."....l..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	141680
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1b0f0	0x0	0x6	AX	16
.fini	PROGBITS	0x231a0	0x1b1a0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x231b4	0x1b1b4	0x2ac8	0x0	0x2	A	4
.ctors	PROGBITS	0x2e000	0x1e000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2e00c	0x1e00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2e020	0x1e020	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x32930	0x22930	0x4580	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x22930	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1dc7c	0x1dc7c	6.0216	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1e000	0x2e000	0x2e000	0x4930	0x8eb0	0.4219	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 00:48:51.802752972 CET	51310	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:51.808149099 CET	33966	51310	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:51.808207035 CET	51310	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:51.809695005 CET	51310	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:51.814429045 CET	33966	51310	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:51.814471006 CET	51310	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:51.819199085 CET	33966	51310	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:52.200391054 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:52.205151081 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:52.207894087 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:52.210495949 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:52.215236902 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:52.456845045 CET	33966	51310	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:52.456906080 CET	51310	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:52.457092047 CET	51310	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:52.543023109 CET	51314	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:52.547843933 CET	33966	51314	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:52.547887087 CET	51314	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:52.549801111 CET	51314	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:52.554611921 CET	33966	51314	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:52.554656982 CET	51314	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:52.560676098 CET	33966	51314	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:52.684020042 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:52.688831091 CET	7733	44766	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:52.690927982 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:52.699407101 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:52.704202890 CET	7733	44766	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.192977905 CET	33966	51314	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:53.193030119 CET	51314	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:53.193059921 CET	51314	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:53.281758070 CET	51318	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:53.286489964 CET	33966	51318	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:53.286535025 CET	51318	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:53.287710905 CET	51318	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:53.307792902 CET	33966	51318	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:53.307828903 CET	51318	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:53.312621117 CET	33966	51318	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:53.492820024 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.497606993 CET	7733	44770	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.497682095 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.498889923 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.501228094 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.503684044 CET	7733	44770	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.506058931 CET	7733	44772	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.506127119 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.507325888 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.510636091 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.512073994 CET	7733	44772	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.515412092 CET	7733	44774	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.515466928 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.516737938 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.518712044 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.521481037 CET	7733	44774	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.523493052 CET	7733	44776	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.523530960 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.524772882 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.527883053 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.529515982 CET	7733	44776	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.532663107 CET	7733	44778	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.532721043 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.533776999 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.538580894 CET	7733	44778	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.591612101 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.596435070 CET	7733	44780	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.597672939 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.662024021 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.666862965 CET	7733	44780	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.703201056 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.707998037 CET	7733	44782	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.708046913 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.710213900 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.714510918 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.714986086 CET	7733	44782	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.719356060 CET	7733	44784	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.719396114 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.721508026 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.726352930 CET	7733	44784	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.726766109 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.731604099 CET	7733	44786	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.731669903 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.736399889 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.738718987 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.741144896 CET	7733	44786	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.743587971 CET	7733	44788	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.743633986 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.748392105 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.752279043 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.753199100 CET	7733	44788	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.757085085 CET	7733	44790	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.757132053 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.758657932 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.763386011 CET	7733	44790	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.770112038 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.774877071 CET	7733	44794	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.774938107 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.778096914 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.782550097 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.782845974 CET	7733	44794	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.787364960 CET	7733	44796	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.787436008 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.789362907 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.792752981 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.794146061 CET	7733	44796	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.797498941 CET	7733	44798	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.797554016 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.800000906 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.804734945 CET	7733	44798	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.804861069 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.809643030 CET	7733	44800	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.809679031 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.812042952 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.816821098 CET	7733	44800	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.817328930 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.822103024 CET	7733	44802	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.822165012 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.824938059 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.830228090 CET	7733	44802	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.838555098 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.843317986 CET	7733	44804	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.843461990 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.852682114 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.857480049 CET	7733	44804	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.871954918 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.876713037 CET	7733	44806	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.878032923 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.882447958 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.887188911 CET	7733	44806	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.891840935 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.896578074 CET	7733	44808	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.896635056 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.898983955 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:53.903719902 CET	7733	44808	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:53.910845995 CET	33966	51318	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:53.910891056 CET	51318	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:53.910923958 CET	51318	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.001099110 CET	51360	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.006062031 CET	33966	51360	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:54.006104946 CET	51360	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.008203983 CET	51360	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.013070107 CET	33966	51360	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:54.013108015 CET	51360	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.017836094 CET	33966	51360	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:54.633656025 CET	33966	51360	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:54.633721113 CET	51360	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.633759022 CET	51360	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.725068092 CET	51362	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.729819059 CET	33966	51362	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:54.729886055 CET	51362	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.731802940 CET	51362	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.737075090 CET	33966	51362	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:54.737117052 CET	51362	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:54.741813898 CET	33966	51362	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:55.374547958 CET	33966	51362	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:55.374614954 CET	51362	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:55.374649048 CET	51362	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:55.465765953 CET	51364	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:55.470637083 CET	33966	51364	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:55.470699072 CET	51364	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:55.472805977 CET	51364	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:55.477572918 CET	33966	51364	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:55.477617979 CET	51364	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:55.482352972 CET	33966	51364	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:55.939424992 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.944201946 CET	7733	44816	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:55.944288015 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.945406914 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.950222015 CET	7733	44816	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:55.958595037 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.963341951 CET	7733	44818	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:55.963413954 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.965451956 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.970196962 CET	7733	44818	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:55.975168943 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.979944944 CET	7733	44820	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:55.979989052 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.981494904 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.985589981 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.986275911 CET	7733	44820	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:55.990324974 CET	7733	44822	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:55.990366936 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.992876053 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:55.997603893 CET	7733	44822	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.005995035 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.012913942 CET	7733	44824	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.012950897 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.014070034 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.015899897 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.018783092 CET	7733	44824	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.020670891 CET	7733	44826	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.020730972 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.021817923 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.023598909 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.026556015 CET	7733	44826	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.028352976 CET	7733	44828	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.028389931 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.030242920 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.032179117 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.035006046 CET	7733	44828	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.036942005 CET	7733	44830	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.037000895 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.038180113 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.040077925 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.042974949 CET	7733	44830	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.044852972 CET	7733	44832	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.044904947 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.046042919 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.047736883 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.050812006 CET	7733	44832	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.052530050 CET	7733	44834	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.052572012 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.053709984 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.055368900 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.058509111 CET	7733	44834	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.060129881 CET	7733	44836	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.060177088 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.061408043 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.063106060 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.066164017 CET	7733	44836	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.067886114 CET	7733	44838	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.067946911 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.069525957 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.071491957 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.074249983 CET	7733	44838	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.076221943 CET	7733	44840	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.076262951 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.077784061 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.079618931 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.082504034 CET	7733	44840	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.084353924 CET	7733	44842	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.084405899 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.085557938 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.087393045 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.090490103 CET	7733	44842	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.092125893 CET	7733	44844	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.092189074 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.093858004 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.095629930 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.098603964 CET	7733	44844	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.102659941 CET	7733	44846	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.102722883 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.103882074 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.105585098 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.108623028 CET	7733	44846	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.110348940 CET	7733	44848	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.110402107 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.112881899 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.115220070 CET	33966	51364	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:56.115302086 CET	51364	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.115302086 CET	51364	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.115338087 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.117605925 CET	7733	44848	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.120122910 CET	7733	44850	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.120191097 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.121280909 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.123182058 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.126009941 CET	7733	44850	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.127931118 CET	7733	44852	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.127970934 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.129339933 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.131881952 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.134069920 CET	7733	44852	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.136611938 CET	7733	44854	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.136648893 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.137959003 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.141066074 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.142728090 CET	7733	44854	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.145787954 CET	7733	44856	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.145831108 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.147305965 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.149791956 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.152019978 CET	7733	44856	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.154553890 CET	7733	44858	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.154594898 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.157416105 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.160604000 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.162180901 CET	7733	44858	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.165431976 CET	7733	44860	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.165477037 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.166661978 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.168524027 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.171395063 CET	7733	44860	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.173279047 CET	7733	44862	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.173324108 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.174959898 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.176590919 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.179748058 CET	7733	44862	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.181407928 CET	7733	44864	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.181452036 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.182553053 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.184401989 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.187357903 CET	7733	44864	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.189176083 CET	7733	44866	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.189220905 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.190223932 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.191783905 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.194312096 CET	51420	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.194962025 CET	7733	44866	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.196540117 CET	7733	44868	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.196589947 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.198642015 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.199054956 CET	33966	51420	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:56.199104071 CET	51420	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.201102972 CET	51420	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.202459097 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.203406096 CET	7733	44868	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.205830097 CET	33966	51420	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:56.205877066 CET	51420	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.207192898 CET	7733	44872	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.207245111 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.208414078 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.210274935 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.210604906 CET	33966	51420	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:56.213155031 CET	7733	44872	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.215028048 CET	7733	44874	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.215082884 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.217720032 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.219743967 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.222460032 CET	7733	44874	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.224493027 CET	7733	44876	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.224531889 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.225615025 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.227371931 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.230333090 CET	7733	44876	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.232116938 CET	7733	44878	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.232157946 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.233170986 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.234963894 CET	44880	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.237879038 CET	7733	44878	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.239727020 CET	7733	44880	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.239773035 CET	44880	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.241823912 CET	44880	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.243413925 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.246552944 CET	7733	44880	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.248186111 CET	7733	44882	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.248224020 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.249631882 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.254348040 CET	7733	44882	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.260277987 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.265029907 CET	7733	44884	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.265104055 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.266283035 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.268054008 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.271013975 CET	7733	44884	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.272785902 CET	7733	44886	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.272842884 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.274054050 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.278772116 CET	7733	44886	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.288810015 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.293641090 CET	7733	44888	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.293699026 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.294838905 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.297048092 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.299577951 CET	7733	44888	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.301853895 CET	7733	44890	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.301914930 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.302978039 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.305007935 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.307719946 CET	7733	44890	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.309756041 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.309792995 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.311021090 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.313517094 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.315782070 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.318304062 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.318348885 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.319416046 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.322865963 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.324234009 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.327689886 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.327732086 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.328834057 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.330535889 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.333605051 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.335350037 CET	7733	44898	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.335396051 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.337500095 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.339140892 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.342276096 CET	7733	44898	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.343897104 CET	7733	44900	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.344125986 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.345810890 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.347480059 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.350544930 CET	7733	44900	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.352230072 CET	7733	44902	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.352277040 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.353539944 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.355267048 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.358308077 CET	7733	44902	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.359991074 CET	7733	44904	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.360061884 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.361763954 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.363342047 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.366558075 CET	7733	44904	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.368134975 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.368187904 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.369410992 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.371011972 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.375613928 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.375787020 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.375833988 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.377140999 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.378829002 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.381894112 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.383626938 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.383666039 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.385236025 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.387305021 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.389961004 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.392082930 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.392123938 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.393681049 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.395756960 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.398499012 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.400525093 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.400566101 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.401669025 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.403544903 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.406374931 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.408334970 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.408390045 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.409513950 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.411343098 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.414244890 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.416100025 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.416135073 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.417439938 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.419255018 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.422203064 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.424098015 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.424143076 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.425498009 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.427180052 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.430243015 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.431957006 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.432004929 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.433764935 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.435465097 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.438525915 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.440234900 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.440272093 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.441437006 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.443111897 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.446161032 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.447921991 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.447967052 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.449615955 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.451558113 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.454341888 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.456341028 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.456396103 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.457619905 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.459527969 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.463460922 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.466377020 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.466445923 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.467437983 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.469965935 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.472136974 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.474708080 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.474744081 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.475754976 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.479252100 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.480505943 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.483990908 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.484050989 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.485198975 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.487154007 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.489917040 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.491905928 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.491962910 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.493602037 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.495320082 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.498296022 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.500077963 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.500133991 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.501410007 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.503022909 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.506191969 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.507853031 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.507910013 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.509824991 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.514615059 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.516338110 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.521173000 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.521223068 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.522361994 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.527113914 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.532066107 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.536909103 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.536962986 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.538062096 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.542815924 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.627612114 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.632416010 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.632482052 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.633728981 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.638478041 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.651763916 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.656524897 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.656649113 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.659240007 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.663958073 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.675635099 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.680409908 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.683731079 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.686127901 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:56.690923929 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:56.821830034 CET	33966	51420	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:56.821914911 CET	51420	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.821914911 CET	51420	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.945075989 CET	51502	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.949918032 CET	33966	51502	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:56.949974060 CET	51502	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.954364061 CET	51502	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.959283113 CET	33966	51502	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:56.959332943 CET	51502	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:56.964170933 CET	33966	51502	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:57.599335909 CET	33966	51502	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:57.599401951 CET	51502	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:57.599446058 CET	51502	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:57.696099997 CET	51504	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:57.700973988 CET	33966	51504	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:57.701061010 CET	51504	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:57.704313040 CET	51504	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:57.709079981 CET	33966	51504	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:57.709125996 CET	51504	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:57.713864088 CET	33966	51504	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:58.371052980 CET	33966	51504	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:58.371938944 CET	51504	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:58.371938944 CET	51504	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:58.487190008 CET	51506	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:58.491992950 CET	33966	51506	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:58.492050886 CET	51506	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:58.495083094 CET	51506	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:58.499892950 CET	33966	51506	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:58.499933004 CET	51506	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:58.504684925 CET	33966	51506	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:58.552459002 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.557257891 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.848856926 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848856926 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848865986 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848865986 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848875046 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848875999 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848891020 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848891020 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848891020 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848891020 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848897934 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848900080 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848897934 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848897934 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848897934 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848906994 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848906994 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848923922 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848923922 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848923922 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848923922 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848927021 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848941088 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848941088 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848949909 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848952055 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848949909 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848952055 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848958015 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848958015 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848963022 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848963022 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848970890 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848970890 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848978996 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848978996 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848978996 CET	44880	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.848978996 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849009037 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849009037 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849015951 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849018097 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849018097 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849023104 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849023104 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849023104 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849023104 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849033117 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849033117 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849034071 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849036932 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849036932 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849040985 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849044085 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849044085 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849060059 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849060059 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849061012 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849061012 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849061012 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849065065 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849065065 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849070072 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849070072 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849071026 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849083900 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849083900 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849086046 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849096060 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849096060 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849096060 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849096060 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849096060 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849112034 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849112034 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849116087 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849116087 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849121094 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849121094 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849121094 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849121094 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849124908 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849124908 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849145889 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849147081 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849147081 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849148989 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.849163055 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:48:58.895026922 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895039082 CET	7733	44772	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895049095 CET	7733	44766	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895057917 CET	7733	44774	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895066023 CET	7733	44770	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895075083 CET	7733	44776	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895082951 CET	7733	44778	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895092964 CET	7733	44780	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895102024 CET	7733	44784	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895112038 CET	7733	44786	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895138025 CET	7733	44782	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895147085 CET	7733	44796	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895155907 CET	7733	44798	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895164013 CET	7733	44788	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895173073 CET	7733	44790	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895180941 CET	7733	44804	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895190001 CET	7733	44800	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895198107 CET	7733	44806	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895206928 CET	7733	44802	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895216942 CET	7733	44794	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895231962 CET	7733	44808	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895243883 CET	7733	44816	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895253897 CET	7733	44818	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895262003 CET	7733	44824	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895271063 CET	7733	44826	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895279884 CET	7733	44820	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895288944 CET	7733	44830	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895297050 CET	7733	44828	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895306110 CET	7733	44822	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895318985 CET	7733	44836	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895328045 CET	7733	44838	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895335913 CET	7733	44832	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895344973 CET	7733	44834	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895351887 CET	7733	44840	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895361900 CET	7733	44842	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895370960 CET	7733	44848	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895380020 CET	7733	44850	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895387888 CET	7733	44844	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895395994 CET	7733	44860	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895404100 CET	7733	44862	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895412922 CET	7733	44846	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895421982 CET	7733	44852	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895433903 CET	7733	44856	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895442009 CET	7733	44854	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895452023 CET	7733	44858	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895461082 CET	7733	44864	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895473957 CET	7733	44866	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895483017 CET	7733	44868	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895492077 CET	7733	44872	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895500898 CET	7733	44874	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895509005 CET	7733	44876	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895513058 CET	7733	44880	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895517111 CET	7733	44882	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895524979 CET	7733	44878	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895533085 CET	7733	44888	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895541906 CET	7733	44890	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895550013 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895558119 CET	7733	44898	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895566940 CET	7733	44884	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895576000 CET	7733	44886	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895584106 CET	7733	44904	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895592928 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895601988 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895612001 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895621061 CET	7733	44900	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895629883 CET	7733	44902	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895637989 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895647049 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895654917 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895663977 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895673037 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895682096 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895689964 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895699024 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895706892 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895715952 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895724058 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895731926 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895740986 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895749092 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895756960 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895765066 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895777941 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895787001 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895797014 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895804882 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895812988 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:58.895821095 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 7, 2025 00:48:59.147167921 CET	33966	51506	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:59.147245884 CET	51506	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:59.147283077 CET	51506	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:59.252692938 CET	51508	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:59.257467985 CET	33966	51508	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:59.257522106 CET	51508	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:59.261518002 CET	51508	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:59.266293049 CET	33966	51508	178.215.238.112	192.168.2.13
Jan 7, 2025 00:48:59.266338110 CET	51508	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:48:59.271106958 CET	33966	51508	178.215.238.112	192.168.2.13
Jan 7, 2025 00:49:00.176918983 CET	35018	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:49:00.181751013 CET	53	35018	8.8.8.8	192.168.2.13
Jan 7, 2025 00:49:00.181813002 CET	35018	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:49:00.181826115 CET	35018	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:49:00.181834936 CET	35018	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:49:00.186722994 CET	53	35018	8.8.8.8	192.168.2.13
Jan 7, 2025 00:49:00.186753988 CET	53	35018	8.8.8.8	192.168.2.13
Jan 7, 2025 00:49:00.648238897 CET	53	35018	8.8.8.8	192.168.2.13
Jan 7, 2025 00:49:00.648328066 CET	35018	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:49:02.646977901 CET	53	35018	8.8.8.8	192.168.2.13
Jan 7, 2025 00:49:02.647090912 CET	35018	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:49:02.651910067 CET	53	35018	8.8.8.8	192.168.2.13
Jan 7, 2025 00:49:13.617736101 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:13.617844105 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:14.039552927 CET	7733	44766	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:14.039629936 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:14.855149031 CET	7733	44770	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:14.855227947 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:14.885416031 CET	7733	44772	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:14.885488987 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:14.887170076 CET	7733	44774	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:14.887222052 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:14.888933897 CET	7733	44776	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:14.888972044 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:14.918382883 CET	7733	44778	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:14.918418884 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.007282972 CET	7733	44780	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.007344007 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.086755037 CET	7733	44784	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.086817026 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.118695974 CET	7733	44788	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.118747950 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.119124889 CET	7733	44786	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.119203091 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.120296955 CET	7733	44790	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.120337009 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.152759075 CET	7733	44782	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.152816057 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.164516926 CET	7733	44798	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.164589882 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.166944981 CET	7733	44794	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.166987896 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.169270039 CET	7733	44796	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.169337034 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.195950031 CET	7733	44800	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.196023941 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.201502085 CET	7733	44802	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.201605082 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.211467981 CET	7733	44804	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.211549044 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.277067900 CET	7733	44806	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.277127981 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:15.294328928 CET	7733	44808	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:15.294382095 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.320955992 CET	7733	44816	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.321058035 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.338165998 CET	7733	44820	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.338222027 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.357836008 CET	7733	44818	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.357897997 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.367192984 CET	7733	44828	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.367239952 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.369518042 CET	7733	44822	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.369570971 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.383275986 CET	7733	44826	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.383326054 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.414948940 CET	7733	44836	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.414992094 CET	7733	44832	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.415021896 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.415029049 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.416799068 CET	7733	44834	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.416847944 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.418943882 CET	7733	44830	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.418981075 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.419013023 CET	7733	44824	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.419049025 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.465404034 CET	7733	44842	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.465461969 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.467027903 CET	7733	44838	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.467076063 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.479255915 CET	7733	44840	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.479300022 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.480061054 CET	7733	44844	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.480102062 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.492645025 CET	7733	44856	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.492697001 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.492784977 CET	7733	44852	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.492825031 CET	7733	44850	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.492839098 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.492907047 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.494510889 CET	7733	44848	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.494689941 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.495722055 CET	7733	44846	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.495763063 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.495800972 CET	7733	44854	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.495839119 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.527827978 CET	7733	44858	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.527909994 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.543345928 CET	7733	44860	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.543399096 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.564400911 CET	7733	44862	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.564459085 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.570852995 CET	7733	44874	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.570878983 CET	7733	44872	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.570893049 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.570919991 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.574588060 CET	7733	44868	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.574636936 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.576427937 CET	7733	44866	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.576539993 CET	7733	44864	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.576556921 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.576577902 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.617750883 CET	7733	44880	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.617805004 CET	44880	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.618304968 CET	7733	44882	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.618351936 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.619461060 CET	7733	44878	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.619502068 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.623351097 CET	7733	44876	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.623410940 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.633510113 CET	7733	44886	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.633570910 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.637144089 CET	7733	44884	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.637204885 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.684526920 CET	7733	44888	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.684598923 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.684616089 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.684695959 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.701572895 CET	7733	44890	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.701662064 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.713223934 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.713274956 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.715261936 CET	7733	44898	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.715317011 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.715604067 CET	7733	44900	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.715677977 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.717102051 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.717137098 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.727089882 CET	7733	44902	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.727152109 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.742717028 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.742769957 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.742841005 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.742885113 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.746501923 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.746529102 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.746547937 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.746570110 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.758358002 CET	7733	44904	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.758392096 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.758411884 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.758435011 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.790338993 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.790397882 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.792609930 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.792690039 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.805252075 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.805303097 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.807105064 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.807152987 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.809921026 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.809967041 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.810775042 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.810817957 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.820719004 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.820765972 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.838582993 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.838629961 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.840754986 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.840791941 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.851615906 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.851654053 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.867799044 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.867855072 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.873358011 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.873404980 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.883270979 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.883322001 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.887093067 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.887144089 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.920250893 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.920324087 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:17.992722988 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:17.992785931 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:18.043514013 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:18.043561935 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:49:18.057081938 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 7, 2025 00:49:18.057135105 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 7, 2025 00:50:09.324533939 CET	51508	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:50:09.329412937 CET	33966	51508	178.215.238.112	192.168.2.13
Jan 7, 2025 00:50:19.332504034 CET	51508	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:50:19.337418079 CET	33966	51508	178.215.238.112	192.168.2.13
Jan 7, 2025 00:50:58.222376108 CET	33966	51508	178.215.238.112	192.168.2.13
Jan 7, 2025 00:50:58.222902060 CET	51508	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:50:58.227655888 CET	33966	51508	178.215.238.112	192.168.2.13
Jan 7, 2025 00:50:59.298168898 CET	51516	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:50:59.302953959 CET	33966	51516	178.215.238.112	192.168.2.13
Jan 7, 2025 00:50:59.303025007 CET	51516	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:50:59.303874969 CET	51516	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:50:59.308680058 CET	33966	51516	178.215.238.112	192.168.2.13
Jan 7, 2025 00:50:59.308737993 CET	51516	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:50:59.313517094 CET	33966	51516	178.215.238.112	192.168.2.13
Jan 7, 2025 00:50:59.988718033 CET	33966	51516	178.215.238.112	192.168.2.13
Jan 7, 2025 00:50:59.988971949 CET	51516	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:50:59.989088058 CET	51516	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.060789108 CET	51518	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.065617085 CET	33966	51518	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:00.065676928 CET	51518	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.066487074 CET	51518	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.071306944 CET	33966	51518	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:00.071353912 CET	51518	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.076128960 CET	33966	51518	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:00.713107109 CET	33966	51518	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:00.713246107 CET	51518	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.713442087 CET	51518	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.786341906 CET	51520	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.791157961 CET	33966	51520	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:00.791207075 CET	51520	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.792052984 CET	51520	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.797463894 CET	33966	51520	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:00.797522068 CET	51520	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:00.802288055 CET	33966	51520	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:01.438083887 CET	33966	51520	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:01.438157082 CET	51520	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:01.438325882 CET	51520	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:01.511161089 CET	51522	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:01.515919924 CET	33966	51522	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:01.515986919 CET	51522	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:01.516848087 CET	51522	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:01.521564960 CET	33966	51522	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:01.521636963 CET	51522	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:01.526420116 CET	33966	51522	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:02.967278957 CET	33966	51522	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:02.967432976 CET	33966	51522	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:02.967473030 CET	33966	51522	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:02.967664957 CET	51522	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:02.967690945 CET	51522	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:02.967710018 CET	51522	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:02.967793941 CET	51522	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.075689077 CET	51524	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.083599091 CET	33966	51524	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:03.083652973 CET	51524	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.084858894 CET	51524	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.092971087 CET	33966	51524	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:03.093019009 CET	51524	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.100584984 CET	33966	51524	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:03.708621979 CET	33966	51524	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:03.708751917 CET	51524	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.708802938 CET	51524	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.780554056 CET	51526	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.785418987 CET	33966	51526	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:03.785490990 CET	51526	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.786372900 CET	51526	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.791121960 CET	33966	51526	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:03.791203976 CET	51526	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:03.795958042 CET	33966	51526	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:04.418262959 CET	33966	51526	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:04.418426991 CET	51526	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:04.418512106 CET	51526	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:04.495606899 CET	51528	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:04.500443935 CET	33966	51528	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:04.500507116 CET	51528	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:04.501682043 CET	51528	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:04.506443977 CET	33966	51528	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:04.506500959 CET	51528	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:04.511255026 CET	33966	51528	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:05.143106937 CET	33966	51528	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:05.143317938 CET	51528	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.143317938 CET	51528	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.215678930 CET	51530	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.220582008 CET	33966	51530	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:05.220634937 CET	51530	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.221451998 CET	51530	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.226219893 CET	33966	51530	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:05.226272106 CET	51530	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.231062889 CET	33966	51530	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:05.872809887 CET	33966	51530	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:05.872920990 CET	51530	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.873060942 CET	51530	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.945499897 CET	51532	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.950288057 CET	33966	51532	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:05.950402021 CET	51532	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.951257944 CET	51532	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.956048965 CET	33966	51532	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:05.956109047 CET	51532	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:05.960892916 CET	33966	51532	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:06.608494997 CET	33966	51532	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:06.608675003 CET	51532	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:06.608757019 CET	51532	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:06.694123983 CET	51534	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:06.698937893 CET	33966	51534	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:06.698997974 CET	51534	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:06.700022936 CET	51534	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:06.704826117 CET	33966	51534	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:06.704888105 CET	51534	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:06.709685087 CET	33966	51534	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:07.346740007 CET	33966	51534	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:07.346786022 CET	51534	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:07.346880913 CET	51534	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:07.418415070 CET	51536	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:07.423239946 CET	33966	51536	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:07.423310995 CET	51536	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:07.424103975 CET	51536	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:07.428853035 CET	33966	51536	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:07.428899050 CET	51536	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:07.433675051 CET	33966	51536	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:08.057733059 CET	33966	51536	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:08.057846069 CET	51536	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.057984114 CET	51536	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.131109953 CET	51538	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.135890961 CET	33966	51538	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:08.135963917 CET	51538	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.136709929 CET	51538	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.141482115 CET	33966	51538	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:08.141540051 CET	51538	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.146270990 CET	33966	51538	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:08.770201921 CET	33966	51538	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:08.770315886 CET	51538	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.770348072 CET	51538	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.842133045 CET	51540	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.846957922 CET	33966	51540	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:08.847023010 CET	51540	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.847839117 CET	51540	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.852643967 CET	33966	51540	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:08.852690935 CET	51540	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:08.857479095 CET	33966	51540	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:09.480575085 CET	33966	51540	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:09.480634928 CET	51540	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:09.480823040 CET	51540	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:09.551757097 CET	51542	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:09.556591988 CET	33966	51542	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:09.556637049 CET	51542	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:09.557243109 CET	51542	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:09.562721968 CET	33966	51542	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:09.562766075 CET	51542	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:09.568053007 CET	33966	51542	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:10.202281952 CET	33966	51542	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:10.202400923 CET	51542	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.202430010 CET	51542	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.275296926 CET	51544	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.280085087 CET	33966	51544	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:10.280144930 CET	51544	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.280848026 CET	51544	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.285578966 CET	33966	51544	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:10.285629034 CET	51544	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.290395021 CET	33966	51544	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:10.904808998 CET	33966	51544	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:10.904907942 CET	51544	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.904968023 CET	51544	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.976855993 CET	51546	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.981684923 CET	33966	51546	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:10.981735945 CET	51546	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.982340097 CET	51546	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.987170935 CET	33966	51546	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:10.987221003 CET	51546	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:10.991993904 CET	33966	51546	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:11.627156973 CET	33966	51546	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:11.627511978 CET	51546	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:11.627511978 CET	51546	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:11.698333025 CET	51548	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:11.703109026 CET	33966	51548	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:11.703156948 CET	51548	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:11.703824043 CET	51548	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:11.708659887 CET	33966	51548	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:11.708699942 CET	51548	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:11.713536978 CET	33966	51548	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:12.354927063 CET	33966	51548	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:12.355035067 CET	51548	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:12.355082989 CET	51548	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:12.425678968 CET	51550	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:12.430510044 CET	33966	51550	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:12.430563927 CET	51550	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:12.431164026 CET	51550	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:12.435929060 CET	33966	51550	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:12.435967922 CET	51550	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:12.440735102 CET	33966	51550	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:13.073681116 CET	33966	51550	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:13.073781967 CET	51550	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.073827028 CET	51550	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.143933058 CET	51552	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.148751974 CET	33966	51552	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:13.148797035 CET	51552	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.149420977 CET	51552	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.154186010 CET	33966	51552	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:13.154232979 CET	51552	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.159074068 CET	33966	51552	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:13.782012939 CET	33966	51552	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:13.782114983 CET	51552	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.782257080 CET	51552	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.852747917 CET	51554	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.857502937 CET	33966	51554	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:13.857551098 CET	51554	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.858186960 CET	51554	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.862945080 CET	33966	51554	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:13.862986088 CET	51554	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:13.867741108 CET	33966	51554	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:14.500066042 CET	33966	51554	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:14.500154972 CET	51554	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:14.500226021 CET	51554	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:14.571088076 CET	51556	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:14.575870991 CET	33966	51556	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:14.575922012 CET	51556	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:14.576709032 CET	51556	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:14.581482887 CET	33966	51556	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:14.581523895 CET	51556	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:14.586298943 CET	33966	51556	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:15.227802038 CET	33966	51556	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:15.227981091 CET	51556	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:15.227981091 CET	51556	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:15.297559977 CET	51558	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:15.302360058 CET	33966	51558	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:15.302397966 CET	51558	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:15.302958965 CET	51558	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:15.307698011 CET	33966	51558	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:15.307734013 CET	51558	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:15.312577009 CET	33966	51558	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:15.936310053 CET	33966	51558	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:15.936427116 CET	51558	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:15.936492920 CET	51558	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.006551027 CET	51560	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.011395931 CET	33966	51560	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:16.011439085 CET	51560	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.012397051 CET	51560	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.017174959 CET	33966	51560	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:16.017210007 CET	51560	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.022062063 CET	33966	51560	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:16.632221937 CET	33966	51560	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:16.632297993 CET	51560	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.632349968 CET	51560	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.702750921 CET	51562	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.707566977 CET	33966	51562	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:16.707628965 CET	51562	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.708252907 CET	51562	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.713016987 CET	33966	51562	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:16.713059902 CET	51562	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:16.717888117 CET	33966	51562	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:17.351888895 CET	33966	51562	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:17.352005005 CET	51562	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:17.352030039 CET	51562	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:17.425681114 CET	51564	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:17.432066917 CET	33966	51564	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:17.432118893 CET	51564	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:17.432723045 CET	51564	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:17.438940048 CET	33966	51564	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:17.438982964 CET	51564	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:17.445274115 CET	33966	51564	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:18.065249920 CET	33966	51564	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:18.065481901 CET	51564	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.065481901 CET	51564	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.137279987 CET	51566	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.142086029 CET	33966	51566	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:18.142139912 CET	51566	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.142713070 CET	51566	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.147537947 CET	33966	51566	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:18.147578955 CET	51566	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.152385950 CET	33966	51566	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:18.790102005 CET	33966	51566	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:18.790194035 CET	51566	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.790247917 CET	51566	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.861530066 CET	51568	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.866391897 CET	33966	51568	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:18.866446972 CET	51568	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.867283106 CET	51568	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.872112036 CET	33966	51568	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:18.872152090 CET	51568	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:18.876939058 CET	33966	51568	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:19.509217978 CET	33966	51568	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:19.509283066 CET	51568	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:19.509325981 CET	51568	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:19.577528954 CET	51570	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:19.582360029 CET	33966	51570	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:19.582403898 CET	51570	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:19.582912922 CET	51570	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:19.587626934 CET	33966	51570	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:19.587663889 CET	51570	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:19.592415094 CET	33966	51570	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:20.205174923 CET	33966	51570	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:20.205296993 CET	51570	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:20.205348015 CET	51570	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:20.276293993 CET	51572	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:20.281125069 CET	33966	51572	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:20.281177998 CET	51572	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:20.281759024 CET	51572	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:20.286528111 CET	33966	51572	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:20.286573887 CET	51572	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:20.291344881 CET	33966	51572	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:21.009802103 CET	33966	51572	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:21.009888887 CET	51572	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.009923935 CET	51572	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.079569101 CET	51574	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.084383965 CET	33966	51574	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:21.084433079 CET	51574	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.084950924 CET	51574	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.089724064 CET	33966	51574	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:21.089767933 CET	51574	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.094527960 CET	33966	51574	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:21.717952013 CET	33966	51574	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:21.718066931 CET	51574	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.718101978 CET	51574	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.788542032 CET	51576	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.793380976 CET	33966	51576	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:21.793427944 CET	51576	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.794143915 CET	51576	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.798943996 CET	33966	51576	178.215.238.112	192.168.2.13
Jan 7, 2025 00:51:21.798985958 CET	51576	33966	192.168.2.13	178.215.238.112
Jan 7, 2025 00:51:21.803807020 CET	33966	51576	178.215.238.112	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 00:48:51.724769115 CET	59631	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:51.734155893 CET	53	59631	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:51.749098063 CET	45651	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:51.755266905 CET	53	45651	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:51.766426086 CET	56874	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:51.772582054 CET	53	56874	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:51.776154995 CET	37099	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:51.782336950 CET	53	37099	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:51.785773993 CET	49203	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:51.791896105 CET	53	49203	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:51.795111895 CET	46724	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:51.802042007 CET	53	46724	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.458877087 CET	37486	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.465763092 CET	53	37486	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.467489958 CET	37051	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.473638058 CET	53	37051	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.475788116 CET	55867	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.481892109 CET	53	55867	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.484004974 CET	33631	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.490422964 CET	53	33631	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.492135048 CET	40773	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.498476028 CET	53	40773	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.501189947 CET	48176	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.507410049 CET	53	48176	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.509845018 CET	44357	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.515984058 CET	53	44357	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.518661022 CET	52395	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.524878979 CET	53	52395	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.527126074 CET	35204	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.533269882 CET	53	35204	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:52.535679102 CET	54020	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:52.541877985 CET	53	54020	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.195065022 CET	33318	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.201486111 CET	53	33318	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.204114914 CET	53127	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.210304976 CET	53	53127	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.213166952 CET	53005	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.219474077 CET	53	53005	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.222371101 CET	56337	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.228346109 CET	53	56337	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.230503082 CET	33597	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.236690998 CET	53	33597	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.239012003 CET	36348	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.245315075 CET	53	36348	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.247936010 CET	33647	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.254416943 CET	53	33647	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.257132053 CET	45440	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.263617039 CET	53	45440	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.266478062 CET	56967	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.272747993 CET	53	56967	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.275144100 CET	34803	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.281265020 CET	53	34803	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.912983894 CET	52031	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.919672012 CET	53	52031	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.921732903 CET	60409	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.927865982 CET	53	60409	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.930952072 CET	32792	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.936932087 CET	53	32792	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.939558029 CET	33308	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.945651054 CET	53	33308	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.948349953 CET	51251	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.954910040 CET	53	51251	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.957689047 CET	32948	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.964034081 CET	53	32948	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.966684103 CET	35493	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.972882986 CET	53	35493	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.975991011 CET	38991	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.982408047 CET	53	38991	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.985162020 CET	43508	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.991285086 CET	53	43508	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:53.993741989 CET	42198	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:53.999811888 CET	53	42198	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.636699915 CET	44177	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.643373966 CET	53	44177	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.645755053 CET	51412	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.652172089 CET	53	51412	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.655064106 CET	43654	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.661247015 CET	53	43654	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.664109945 CET	59575	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.670314074 CET	53	59575	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.673655033 CET	57206	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.679811001 CET	53	57206	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.682521105 CET	36120	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.688817978 CET	53	36120	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.691515923 CET	55915	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.697783947 CET	53	55915	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.700719118 CET	38518	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.706819057 CET	53	38518	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.709096909 CET	58838	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.715265036 CET	53	58838	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:54.717628956 CET	33750	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:54.723823071 CET	53	33750	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.378236055 CET	41205	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.384505033 CET	53	41205	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.387604952 CET	50348	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.394010067 CET	53	50348	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.396271944 CET	36854	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.402590990 CET	53	36854	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.405422926 CET	44174	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.411634922 CET	53	44174	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.414391041 CET	55748	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.420795918 CET	53	55748	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.423537016 CET	55793	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.429641962 CET	53	55793	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.431895018 CET	47940	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.438128948 CET	53	47940	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.440865993 CET	40193	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.447065115 CET	53	40193	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.449407101 CET	52673	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.455780029 CET	53	52673	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:55.458095074 CET	56366	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:55.464685917 CET	53	56366	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.116316080 CET	43064	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.122678995 CET	53	43064	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.123816013 CET	37527	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.129972935 CET	53	37527	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.131793976 CET	54050	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.138000965 CET	53	54050	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.139877081 CET	53966	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.146575928 CET	53	53966	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.148468971 CET	54718	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.154520035 CET	53	54718	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.156585932 CET	40134	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.162873983 CET	53	40134	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.164252996 CET	42857	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.170649052 CET	53	42857	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.172107935 CET	32826	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.178212881 CET	53	32826	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.179578066 CET	58271	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.185899019 CET	53	58271	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.187123060 CET	55256	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.193564892 CET	53	55256	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.827255011 CET	56915	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.833650112 CET	53	56915	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.838233948 CET	47058	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.844533920 CET	53	47058	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.848931074 CET	55553	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.855099916 CET	53	55553	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.866580963 CET	51323	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.872823954 CET	53	51323	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.879009008 CET	44225	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.885260105 CET	53	44225	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.890703917 CET	36145	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.897351980 CET	53	36145	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.902787924 CET	60296	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.909029007 CET	53	60296	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.914315939 CET	37801	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.920500040 CET	53	37801	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.925144911 CET	47477	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.931412935 CET	53	47477	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:56.936279058 CET	40564	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:56.942522049 CET	53	40564	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.602449894 CET	38991	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.608680010 CET	53	38991	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.611850023 CET	57030	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.618052006 CET	53	57030	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.621292114 CET	47398	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.627707958 CET	53	47398	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.630696058 CET	35769	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.636881113 CET	53	35769	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.640997887 CET	43016	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.647727966 CET	53	43016	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.651201010 CET	41675	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.657398939 CET	53	41675	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.660669088 CET	42478	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.666862011 CET	53	42478	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.669869900 CET	43165	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.676076889 CET	53	43165	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.678643942 CET	44922	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.684856892 CET	53	44922	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:57.688257933 CET	40047	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:57.694431067 CET	53	40047	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.387403965 CET	43109	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.394592047 CET	53	43109	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.397650003 CET	54326	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.405050039 CET	53	54326	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.408828974 CET	41924	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.415783882 CET	53	41924	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.418932915 CET	38092	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.425123930 CET	53	38092	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.429521084 CET	37980	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.435765028 CET	53	37980	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.439250946 CET	33159	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.445702076 CET	53	33159	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.449954987 CET	41333	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.456120968 CET	53	41333	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.459974051 CET	36216	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.466293097 CET	53	36216	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.469212055 CET	50587	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.475395918 CET	53	50587	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:58.479262114 CET	50976	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:58.485559940 CET	53	50976	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.151145935 CET	38083	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.157437086 CET	53	38083	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.161842108 CET	54558	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.168370008 CET	53	54558	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.172079086 CET	33332	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.178433895 CET	53	33332	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.183192015 CET	58675	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.189455032 CET	53	58675	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.193497896 CET	50102	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.199670076 CET	53	50102	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.203048944 CET	43417	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.209286928 CET	53	43417	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.213072062 CET	52312	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.219250917 CET	53	52312	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.223377943 CET	47870	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.229984999 CET	53	47870	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.234231949 CET	46304	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.240452051 CET	53	46304	8.8.8.8	192.168.2.13
Jan 7, 2025 00:48:59.244534969 CET	59628	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:48:59.250621080 CET	53	59628	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.226605892 CET	33342	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.232950926 CET	53	33342	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.233985901 CET	55245	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.240243912 CET	53	55245	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.241354942 CET	57459	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.247684956 CET	53	57459	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.248708010 CET	45344	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.254899025 CET	53	45344	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.255897045 CET	41488	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.262120008 CET	53	41488	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.263123989 CET	35971	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.269264936 CET	53	35971	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.270190954 CET	54638	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.276586056 CET	53	54638	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.277482986 CET	53514	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.283540964 CET	53	53514	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.284427881 CET	48190	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.290652990 CET	53	48190	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.291532040 CET	33281	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.297718048 CET	53	33281	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.990164042 CET	57678	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:50:59.996145010 CET	53	57678	8.8.8.8	192.168.2.13
Jan 7, 2025 00:50:59.997051954 CET	42047	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.003520012 CET	53	42047	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.004436970 CET	38615	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.010787010 CET	53	38615	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.011708021 CET	35229	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.017926931 CET	53	35229	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.018836021 CET	56211	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.024907112 CET	53	56211	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.025829077 CET	56167	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.032008886 CET	53	56167	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.032890081 CET	32863	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.039216995 CET	53	32863	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.040230036 CET	36031	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.046389103 CET	53	36031	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.047234058 CET	38421	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.053319931 CET	53	38421	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.054212093 CET	50893	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.060355902 CET	53	50893	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.714586973 CET	48488	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.721076012 CET	53	48488	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.721879959 CET	51887	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.728231907 CET	53	51887	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.729202032 CET	41739	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.735318899 CET	53	41739	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.736244917 CET	39884	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.742536068 CET	53	39884	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.743483067 CET	46769	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.749916077 CET	53	46769	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.750860929 CET	44164	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.757304907 CET	53	44164	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.758222103 CET	41903	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.764471054 CET	53	41903	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.765356064 CET	42995	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.771639109 CET	53	42995	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.772535086 CET	50335	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.778795958 CET	53	50335	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:00.779654026 CET	58956	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:00.785897017 CET	53	58956	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.439450979 CET	36582	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.445714951 CET	53	36582	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.446619034 CET	44148	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.453690052 CET	53	44148	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.454538107 CET	53477	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.460778952 CET	53	53477	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.461613894 CET	42495	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.468118906 CET	53	42495	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.468997955 CET	37086	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.475267887 CET	53	37086	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.476141930 CET	43123	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.482338905 CET	53	43123	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.483244896 CET	39476	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.489342928 CET	53	39476	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.490231991 CET	43668	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.496414900 CET	53	43668	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.497298002 CET	43202	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.503658056 CET	53	43202	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:01.504534006 CET	43369	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:01.510723114 CET	53	43369	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:02.968756914 CET	33053	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:02.980014086 CET	53	33053	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:02.980823994 CET	36905	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:02.990005970 CET	53	36905	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:02.990792990 CET	54359	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.004812956 CET	53	54359	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.005712986 CET	45108	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.015026093 CET	53	45108	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.015983105 CET	42237	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.025271893 CET	53	42237	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.026122093 CET	41913	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.035386086 CET	53	41913	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.036215067 CET	55280	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.045443058 CET	53	55280	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.046340942 CET	57588	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.055094957 CET	53	57588	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.055939913 CET	45640	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.065196991 CET	53	45640	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.065964937 CET	52482	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.075330019 CET	53	52482	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.709714890 CET	49390	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.715962887 CET	53	49390	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.716691017 CET	52049	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.722888947 CET	53	52049	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.723603964 CET	49607	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.729896069 CET	53	49607	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.731759071 CET	41176	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.738142014 CET	53	41176	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.738843918 CET	58650	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.745265961 CET	53	58650	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.745968103 CET	43390	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.752269030 CET	53	43390	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.752991915 CET	39158	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.759176016 CET	53	39158	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.759855986 CET	38884	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.766168118 CET	53	38884	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.766875982 CET	46684	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.773391008 CET	53	46684	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:03.774084091 CET	46803	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:03.780214071 CET	53	46803	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.419610977 CET	52252	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.425901890 CET	53	52252	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.428910971 CET	35465	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.435220003 CET	53	35465	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.436134100 CET	36797	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.442692041 CET	53	36797	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.443603992 CET	55839	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.449904919 CET	53	55839	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.450809002 CET	39482	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.457062006 CET	53	39482	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.458245039 CET	44538	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.464581966 CET	53	44538	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.465742111 CET	45964	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.472222090 CET	53	45964	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.473407030 CET	36772	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.479902029 CET	53	36772	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.481086016 CET	48747	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.487618923 CET	53	48747	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:04.488749027 CET	41587	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:04.495001078 CET	53	41587	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.144221067 CET	49349	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.150598049 CET	53	49349	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.151367903 CET	36724	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.157497883 CET	53	36724	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.158377886 CET	39356	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.164932966 CET	53	39356	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.165802956 CET	48820	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.172275066 CET	53	48820	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.173154116 CET	34858	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.179331064 CET	53	34858	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.180227041 CET	36640	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.186870098 CET	53	36640	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.187760115 CET	36911	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.194020987 CET	53	36911	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.194914103 CET	36967	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.200854063 CET	53	36967	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.201742887 CET	56654	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.207962036 CET	53	56654	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.208848000 CET	50570	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.215243101 CET	53	50570	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.874150038 CET	34017	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.880208015 CET	53	34017	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.881032944 CET	52119	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.887499094 CET	53	52119	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.888386011 CET	33208	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.895067930 CET	53	33208	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.895956993 CET	53361	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.902194977 CET	53	53361	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.903105021 CET	42459	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.909286022 CET	53	42459	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.910207987 CET	54701	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.916471004 CET	53	54701	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.917370081 CET	58801	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.923651934 CET	53	58801	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.924576044 CET	47705	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.930952072 CET	53	47705	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.931809902 CET	33584	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.937944889 CET	53	33584	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:05.938832045 CET	49596	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:05.945059061 CET	53	49596	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.609884977 CET	44748	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.618618965 CET	53	44748	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.619565964 CET	48086	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.628403902 CET	53	48086	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.629352093 CET	55669	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.638139009 CET	53	55669	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.639118910 CET	53230	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.647869110 CET	53	53230	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.648802042 CET	57465	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.657728910 CET	53	57465	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.658636093 CET	59204	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.665216923 CET	53	59204	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.666075945 CET	33741	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.672257900 CET	53	33741	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.673176050 CET	52891	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.679478884 CET	53	52891	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.680355072 CET	56507	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.686615944 CET	53	56507	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:06.687496901 CET	33452	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:06.693681955 CET	53	33452	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.347692966 CET	55452	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.354027987 CET	53	55452	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.354906082 CET	44315	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.361069918 CET	53	44315	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.361877918 CET	38256	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.368577957 CET	53	38256	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.369379044 CET	60968	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.375622988 CET	53	60968	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.376415968 CET	43162	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.382646084 CET	53	43162	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.383485079 CET	56415	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.389610052 CET	53	56415	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.390414953 CET	42223	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.396682024 CET	53	42223	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.397315979 CET	53578	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.403538942 CET	53	53578	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.404158115 CET	45197	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.410706997 CET	53	45197	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:07.411325932 CET	36566	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:07.417963028 CET	53	36566	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.059087992 CET	36243	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.065315962 CET	53	36243	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.066159964 CET	51502	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.072324991 CET	53	51502	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.073131084 CET	47251	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.079374075 CET	53	47251	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.080152988 CET	56925	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.086391926 CET	53	56925	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.087167978 CET	38731	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.093441963 CET	53	38731	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.094279051 CET	57590	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.101186991 CET	53	57590	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.101995945 CET	38429	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.108741999 CET	53	38429	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.109359980 CET	55717	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.115679979 CET	53	55717	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.116274118 CET	44092	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.123337030 CET	53	44092	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.123940945 CET	44084	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.130722046 CET	53	44084	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.771136045 CET	50472	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.777597904 CET	53	50472	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.778444052 CET	34366	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.784729004 CET	53	34366	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.785559893 CET	41810	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.792390108 CET	53	41810	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.793211937 CET	48959	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.799721956 CET	53	48959	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.800543070 CET	51159	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.806967020 CET	53	51159	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.807833910 CET	51746	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.813960075 CET	53	51746	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.814599037 CET	38125	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.820818901 CET	53	38125	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.821438074 CET	32835	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.827645063 CET	53	32835	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.828260899 CET	48282	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.834563017 CET	53	48282	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:08.835283995 CET	38005	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:08.841675043 CET	53	38005	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.481770039 CET	55723	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.488049030 CET	53	55723	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.488899946 CET	58412	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.495266914 CET	53	58412	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.496066093 CET	39710	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.502327919 CET	53	39710	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.503165007 CET	33056	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.509349108 CET	53	33056	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.510145903 CET	55077	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.516640902 CET	53	55077	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.517254114 CET	57257	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.523629904 CET	53	57257	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.524240017 CET	44232	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.530430079 CET	53	44232	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.531253099 CET	42433	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.537683964 CET	53	42433	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.538306952 CET	55261	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.544522047 CET	53	55261	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:09.545146942 CET	43715	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:09.551430941 CET	53	43715	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.203496933 CET	52804	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.209887028 CET	53	52804	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.210843086 CET	57225	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.217187881 CET	53	57225	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.218024015 CET	55324	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.224442959 CET	53	55324	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.225109100 CET	41338	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.231384039 CET	53	41338	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.232140064 CET	60248	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.238886118 CET	53	60248	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.239852905 CET	59237	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.246516943 CET	53	59237	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.247308016 CET	56777	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.253912926 CET	53	56777	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.254703045 CET	41000	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.260973930 CET	53	41000	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.261651993 CET	43122	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.267875910 CET	53	43122	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.268683910 CET	42072	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.274869919 CET	53	42072	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.905802965 CET	36256	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.912364960 CET	53	36256	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.913031101 CET	53994	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.919575930 CET	53	53994	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.920367956 CET	45660	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.926862001 CET	53	45660	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.927642107 CET	54865	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.934056997 CET	53	54865	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.934874058 CET	41820	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.941046953 CET	53	41820	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.941740990 CET	38313	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.948025942 CET	53	38313	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.949043989 CET	58042	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.955406904 CET	53	58042	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.956192017 CET	54203	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.962474108 CET	53	54203	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.963223934 CET	60961	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.969392061 CET	53	60961	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:10.970174074 CET	40898	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:10.976519108 CET	53	40898	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.628351927 CET	35787	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.634700060 CET	53	35787	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.635366917 CET	45822	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.641623020 CET	53	45822	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.642312050 CET	55199	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.648870945 CET	53	55199	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.649658918 CET	54476	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.656028986 CET	53	54476	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.656714916 CET	52597	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.663034916 CET	53	52597	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.663975000 CET	33697	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.670303106 CET	53	33697	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.670958996 CET	42371	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.677200079 CET	53	42371	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.677862883 CET	59244	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.684093952 CET	53	59244	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.684752941 CET	51807	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.691044092 CET	53	51807	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:11.691692114 CET	44651	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:11.697968960 CET	53	44651	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.355968952 CET	60839	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.362171888 CET	53	60839	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.362848043 CET	60579	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.369072914 CET	53	60579	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.369757891 CET	47244	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.375988960 CET	53	47244	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.376652956 CET	54184	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.383151054 CET	53	54184	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.383759975 CET	58752	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.390167952 CET	53	58752	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.390789032 CET	52575	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.397161007 CET	53	52575	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.397775888 CET	39185	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.404355049 CET	53	39185	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.404988050 CET	53236	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.411336899 CET	53	53236	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.411956072 CET	33810	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.418467999 CET	53	33810	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:12.419100046 CET	46070	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:12.425403118 CET	53	46070	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.074759007 CET	50158	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.081008911 CET	53	50158	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.081705093 CET	34162	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.088100910 CET	53	34162	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.088778019 CET	37174	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.095076084 CET	53	37174	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.095766068 CET	39194	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.102152109 CET	53	39194	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.102823019 CET	58790	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.108972073 CET	53	58790	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.109651089 CET	40235	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.115967989 CET	53	40235	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.116609097 CET	47524	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.122916937 CET	53	47524	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.123600960 CET	47682	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.129929066 CET	53	47682	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.130603075 CET	59199	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.136678934 CET	53	59199	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.137337923 CET	49785	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.143605947 CET	53	49785	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.783103943 CET	57206	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.789343119 CET	53	57206	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.790009022 CET	33436	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.796619892 CET	53	33436	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.797245979 CET	58248	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.803826094 CET	53	58248	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.804478884 CET	36760	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.810826063 CET	53	36760	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.811503887 CET	57251	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.817776918 CET	53	57251	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.818440914 CET	40957	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.824654102 CET	53	40957	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.825282097 CET	53599	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.831603050 CET	53	53599	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.832242012 CET	54720	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.838583946 CET	53	54720	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.839342117 CET	47908	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.845485926 CET	53	47908	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:13.846144915 CET	52881	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:13.852427006 CET	53	52881	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.501180887 CET	41525	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.507486105 CET	53	41525	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.508402109 CET	41366	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.514760017 CET	53	41366	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.515760899 CET	55553	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.521908998 CET	53	55553	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.522721052 CET	43874	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.529174089 CET	53	43874	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.529863119 CET	59572	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.536103010 CET	53	59572	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.536747932 CET	49696	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.542871952 CET	53	49696	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.543478966 CET	39124	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.549787045 CET	53	39124	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.550427914 CET	51180	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.556627035 CET	53	51180	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.557456970 CET	45898	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.563564062 CET	53	45898	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:14.564364910 CET	34761	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:14.570686102 CET	53	34761	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.228727102 CET	36378	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.235213995 CET	53	36378	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.235886097 CET	54863	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.242191076 CET	53	54863	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.242815971 CET	55427	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.249094009 CET	53	55427	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.249692917 CET	41080	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.255944014 CET	53	41080	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.256597996 CET	57778	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.262885094 CET	53	57778	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.263493061 CET	50104	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.269520998 CET	53	50104	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.270144939 CET	34922	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.276437044 CET	53	34922	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.277054071 CET	44980	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.283233881 CET	53	44980	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.284065962 CET	38410	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.290079117 CET	53	38410	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.290673018 CET	33531	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.297267914 CET	53	33531	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.937582970 CET	46827	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.943933964 CET	53	46827	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.944726944 CET	50592	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.951256990 CET	53	50592	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.951858997 CET	47176	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.958173990 CET	53	47176	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.958790064 CET	37680	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.965267897 CET	53	37680	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.965887070 CET	42842	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.972007990 CET	53	42842	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.972589016 CET	56019	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.978806019 CET	53	56019	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.979449034 CET	53946	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.985681057 CET	53	53946	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.986318111 CET	45388	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.992620945 CET	53	45388	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:15.993228912 CET	52794	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:15.999602079 CET	53	52794	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.000235081 CET	49684	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.006254911 CET	53	49684	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.633151054 CET	34956	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.639518023 CET	53	34956	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.640182972 CET	58044	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.646420002 CET	53	58044	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.647018909 CET	37086	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.653520107 CET	53	37086	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.654108047 CET	55466	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.660409927 CET	53	55466	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.661251068 CET	58243	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.667469978 CET	53	58243	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.668087959 CET	36853	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.674611092 CET	53	36853	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.675211906 CET	57922	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.681273937 CET	53	57922	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.681864023 CET	53914	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.688092947 CET	53	53914	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.688787937 CET	59511	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.695152998 CET	53	59511	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:16.695749044 CET	57899	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:16.702246904 CET	53	57899	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.352876902 CET	52745	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.361012936 CET	53	52745	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.361793995 CET	52675	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.368007898 CET	53	52675	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.368755102 CET	49126	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.374927998 CET	53	49126	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.375793934 CET	58722	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.382056952 CET	53	58722	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.382775068 CET	38577	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.389291048 CET	53	38577	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.390043974 CET	43847	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.396313906 CET	53	43847	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.396964073 CET	43671	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.403162003 CET	53	43671	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.403776884 CET	41673	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.410098076 CET	53	41673	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.410686970 CET	49259	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.416847944 CET	53	49259	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:17.417459965 CET	42224	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:17.425358057 CET	53	42224	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.066382885 CET	42728	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.072669983 CET	53	42728	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.073323011 CET	33006	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.079741001 CET	53	33006	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.080384016 CET	37885	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.086529016 CET	53	37885	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.087101936 CET	41231	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.093347073 CET	53	41231	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.093980074 CET	42743	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.100186110 CET	53	42743	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.100819111 CET	50673	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.106986046 CET	53	50673	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.107604980 CET	38367	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.113873005 CET	53	38367	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.114527941 CET	51261	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.121442080 CET	53	51261	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.122128010 CET	52132	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.129571915 CET	53	52132	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.130199909 CET	36930	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.136980057 CET	53	36930	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.791078091 CET	37056	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.797552109 CET	53	37056	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.798214912 CET	39279	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.804636002 CET	53	39279	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.805295944 CET	58061	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.811646938 CET	53	58061	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.812669992 CET	48037	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.819108963 CET	53	48037	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.819727898 CET	41231	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.826087952 CET	53	41231	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.826760054 CET	49176	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.832952976 CET	53	49176	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.833589077 CET	48906	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.839838982 CET	53	48906	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.840564013 CET	51460	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.847029924 CET	53	51460	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.847698927 CET	35574	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.854186058 CET	53	35574	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:18.854927063 CET	36213	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:18.861210108 CET	53	36213	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.509926081 CET	36018	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.515955925 CET	53	36018	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.516550064 CET	36245	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.522994995 CET	53	36245	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.523550987 CET	42874	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.529822111 CET	53	42874	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.530368090 CET	37258	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.536586046 CET	53	37258	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.537136078 CET	34724	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.543279886 CET	53	34724	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.543864965 CET	50956	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.550019979 CET	53	50956	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.550559998 CET	55205	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.557034969 CET	53	55205	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.557568073 CET	56187	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.563833952 CET	53	56187	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.564378023 CET	33397	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.570529938 CET	53	33397	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:19.571069956 CET	38418	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:19.577260971 CET	53	38418	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.206104994 CET	51534	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.212788105 CET	53	51534	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.213460922 CET	60693	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.219753981 CET	53	60693	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.220370054 CET	44182	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.226706982 CET	53	44182	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.227330923 CET	41452	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.233999968 CET	53	41452	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.234657049 CET	46255	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.240892887 CET	53	46255	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.241547108 CET	58237	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.247792006 CET	53	58237	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.248382092 CET	57666	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.254705906 CET	53	57666	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.255306005 CET	43909	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.261976004 CET	53	43909	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.262559891 CET	33851	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.268898964 CET	53	33851	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:20.269484043 CET	35112	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:20.276011944 CET	53	35112	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.010729074 CET	57546	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.017102003 CET	53	57546	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.017852068 CET	45821	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.024097919 CET	53	45821	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.024708033 CET	47683	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.031120062 CET	53	47683	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.031714916 CET	39047	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.037889957 CET	53	39047	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.038484097 CET	47390	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.044776917 CET	53	47390	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.045372009 CET	33903	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.051590919 CET	53	33903	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.052155018 CET	53240	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.058471918 CET	53	53240	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.059048891 CET	49994	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.065258980 CET	53	49994	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.065824032 CET	60515	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.072068930 CET	53	60515	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.072633028 CET	36843	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.079282045 CET	53	36843	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.718867064 CET	59647	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.725276947 CET	53	59647	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.726042032 CET	57376	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.732070923 CET	53	57376	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.732726097 CET	44393	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.739200115 CET	53	44393	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.739881039 CET	38675	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.747066021 CET	53	38675	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.747646093 CET	41790	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.753958941 CET	53	41790	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.754702091 CET	55162	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.760905981 CET	53	55162	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.761490107 CET	39600	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.767800093 CET	53	39600	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.768399000 CET	59311	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.774751902 CET	53	59311	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.775305033 CET	41476	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.781301022 CET	53	41476	8.8.8.8	192.168.2.13
Jan 7, 2025 00:51:21.781960011 CET	49889	53	192.168.2.13	8.8.8.8
Jan 7, 2025 00:51:21.788250923 CET	53	49889	8.8.8.8	192.168.2.13

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 7, 2025 00:49:01.072767973 CET	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable
Jan 7, 2025 00:50:21.083905935 CET	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 00:48:51.724769115 CET	192.168.2.13	8.8.8.8	0xbb3	Standard query (0)	fingwi.cardiacpure.ru	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:48:51.749098063 CET	192.168.2.13	8.8.8.8	0x178e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	483	false
Jan 7, 2025 00:48:51.766426086 CET	192.168.2.13	8.8.8.8	0x178e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	483	false
Jan 7, 2025 00:48:51.776154995 CET	192.168.2.13	8.8.8.8	0x178e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	483	false
Jan 7, 2025 00:48:51.785773993 CET	192.168.2.13	8.8.8.8	0x178e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	483	false
Jan 7, 2025 00:48:51.795111895 CET	192.168.2.13	8.8.8.8	0x178e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	483	false
Jan 7, 2025 00:48:52.501189947 CET	192.168.2.13	8.8.8.8	0x4a2e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	484	false
Jan 7, 2025 00:48:52.509845018 CET	192.168.2.13	8.8.8.8	0x4a2e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	484	false
Jan 7, 2025 00:48:52.518661022 CET	192.168.2.13	8.8.8.8	0x4a2e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	484	false
Jan 7, 2025 00:48:52.527126074 CET	192.168.2.13	8.8.8.8	0x4a2e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	484	false
Jan 7, 2025 00:48:52.535679102 CET	192.168.2.13	8.8.8.8	0x4a2e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	484	false
Jan 7, 2025 00:48:53.239012003 CET	192.168.2.13	8.8.8.8	0x7851	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.247936010 CET	192.168.2.13	8.8.8.8	0x7851	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.257132053 CET	192.168.2.13	8.8.8.8	0x7851	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.266478062 CET	192.168.2.13	8.8.8.8	0x7851	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.275144100 CET	192.168.2.13	8.8.8.8	0x7851	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.957689047 CET	192.168.2.13	8.8.8.8	0xf495	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.966684103 CET	192.168.2.13	8.8.8.8	0xf495	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.975991011 CET	192.168.2.13	8.8.8.8	0xf495	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.985162020 CET	192.168.2.13	8.8.8.8	0xf495	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:53.993741989 CET	192.168.2.13	8.8.8.8	0xf495	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	485	false
Jan 7, 2025 00:48:54.682521105 CET	192.168.2.13	8.8.8.8	0xedd3	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	486	false
Jan 7, 2025 00:48:54.691515923 CET	192.168.2.13	8.8.8.8	0xedd3	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	486	false
Jan 7, 2025 00:48:54.700719118 CET	192.168.2.13	8.8.8.8	0xedd3	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	486	false
Jan 7, 2025 00:48:54.709096909 CET	192.168.2.13	8.8.8.8	0xedd3	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	486	false
Jan 7, 2025 00:48:54.717628956 CET	192.168.2.13	8.8.8.8	0xedd3	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	486	false
Jan 7, 2025 00:48:55.423537016 CET	192.168.2.13	8.8.8.8	0xf77b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	487	false
Jan 7, 2025 00:48:55.431895018 CET	192.168.2.13	8.8.8.8	0xf77b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	487	false
Jan 7, 2025 00:48:55.440865993 CET	192.168.2.13	8.8.8.8	0xf77b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	487	false
Jan 7, 2025 00:48:55.449407101 CET	192.168.2.13	8.8.8.8	0xf77b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	487	false
Jan 7, 2025 00:48:55.458095074 CET	192.168.2.13	8.8.8.8	0xf77b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	487	false
Jan 7, 2025 00:48:56.156585932 CET	192.168.2.13	8.8.8.8	0x72df	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.164252996 CET	192.168.2.13	8.8.8.8	0x72df	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.172107935 CET	192.168.2.13	8.8.8.8	0x72df	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.179578066 CET	192.168.2.13	8.8.8.8	0x72df	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.187123060 CET	192.168.2.13	8.8.8.8	0x72df	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.890703917 CET	192.168.2.13	8.8.8.8	0x5a23	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.902787924 CET	192.168.2.13	8.8.8.8	0x5a23	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.914315939 CET	192.168.2.13	8.8.8.8	0x5a23	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.925144911 CET	192.168.2.13	8.8.8.8	0x5a23	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:56.936279058 CET	192.168.2.13	8.8.8.8	0x5a23	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	488	false
Jan 7, 2025 00:48:57.651201010 CET	192.168.2.13	8.8.8.8	0x446c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	489	false
Jan 7, 2025 00:48:57.660669088 CET	192.168.2.13	8.8.8.8	0x446c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	489	false
Jan 7, 2025 00:48:57.669869900 CET	192.168.2.13	8.8.8.8	0x446c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	489	false
Jan 7, 2025 00:48:57.678643942 CET	192.168.2.13	8.8.8.8	0x446c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	489	false
Jan 7, 2025 00:48:57.688257933 CET	192.168.2.13	8.8.8.8	0x446c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	489	false
Jan 7, 2025 00:48:58.439250946 CET	192.168.2.13	8.8.8.8	0xdab1	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	490	false
Jan 7, 2025 00:48:58.449954987 CET	192.168.2.13	8.8.8.8	0xdab1	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	490	false
Jan 7, 2025 00:48:58.459974051 CET	192.168.2.13	8.8.8.8	0xdab1	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	490	false
Jan 7, 2025 00:48:58.469212055 CET	192.168.2.13	8.8.8.8	0xdab1	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	490	false
Jan 7, 2025 00:48:58.479262114 CET	192.168.2.13	8.8.8.8	0xdab1	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	490	false
Jan 7, 2025 00:48:59.203048944 CET	192.168.2.13	8.8.8.8	0x3119	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	491	false
Jan 7, 2025 00:48:59.213072062 CET	192.168.2.13	8.8.8.8	0x3119	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	491	false
Jan 7, 2025 00:48:59.223377943 CET	192.168.2.13	8.8.8.8	0x3119	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	491	false
Jan 7, 2025 00:48:59.234231949 CET	192.168.2.13	8.8.8.8	0x3119	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	491	false
Jan 7, 2025 00:48:59.244534969 CET	192.168.2.13	8.8.8.8	0x3119	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	491	false
Jan 7, 2025 00:49:00.181826115 CET	192.168.2.13	8.8.8.8	0x4482	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:00.181834936 CET	192.168.2.13	8.8.8.8	0xf6a5	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 7, 2025 00:50:59.263123989 CET	192.168.2.13	8.8.8.8	0x2ab	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	355	false
Jan 7, 2025 00:50:59.270190954 CET	192.168.2.13	8.8.8.8	0x2ab	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	355	false
Jan 7, 2025 00:50:59.277482986 CET	192.168.2.13	8.8.8.8	0x2ab	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	355	false
Jan 7, 2025 00:50:59.284427881 CET	192.168.2.13	8.8.8.8	0x2ab	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	355	false
Jan 7, 2025 00:50:59.291532040 CET	192.168.2.13	8.8.8.8	0x2ab	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	355	false
Jan 7, 2025 00:51:00.025829077 CET	192.168.2.13	8.8.8.8	0x475b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.032890081 CET	192.168.2.13	8.8.8.8	0x475b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.040230036 CET	192.168.2.13	8.8.8.8	0x475b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.047234058 CET	192.168.2.13	8.8.8.8	0x475b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.054212093 CET	192.168.2.13	8.8.8.8	0x475b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.750860929 CET	192.168.2.13	8.8.8.8	0xcce6	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.758222103 CET	192.168.2.13	8.8.8.8	0xcce6	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.765356064 CET	192.168.2.13	8.8.8.8	0xcce6	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.772535086 CET	192.168.2.13	8.8.8.8	0xcce6	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:00.779654026 CET	192.168.2.13	8.8.8.8	0xcce6	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	356	false
Jan 7, 2025 00:51:01.476141930 CET	192.168.2.13	8.8.8.8	0xaf11	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	357	false
Jan 7, 2025 00:51:01.483244896 CET	192.168.2.13	8.8.8.8	0xaf11	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	357	false
Jan 7, 2025 00:51:01.490231991 CET	192.168.2.13	8.8.8.8	0xaf11	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	357	false
Jan 7, 2025 00:51:01.497298002 CET	192.168.2.13	8.8.8.8	0xaf11	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	357	false
Jan 7, 2025 00:51:01.504534006 CET	192.168.2.13	8.8.8.8	0xaf11	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	357	false
Jan 7, 2025 00:51:03.026122093 CET	192.168.2.13	8.8.8.8	0x2549	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.036215067 CET	192.168.2.13	8.8.8.8	0x2549	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.046340942 CET	192.168.2.13	8.8.8.8	0x2549	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.055939913 CET	192.168.2.13	8.8.8.8	0x2549	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.065964937 CET	192.168.2.13	8.8.8.8	0x2549	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.745968103 CET	192.168.2.13	8.8.8.8	0x127d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.752991915 CET	192.168.2.13	8.8.8.8	0x127d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.759855986 CET	192.168.2.13	8.8.8.8	0x127d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.766875982 CET	192.168.2.13	8.8.8.8	0x127d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:03.774084091 CET	192.168.2.13	8.8.8.8	0x127d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	359	false
Jan 7, 2025 00:51:04.458245039 CET	192.168.2.13	8.8.8.8	0x7ac9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	360	false
Jan 7, 2025 00:51:04.465742111 CET	192.168.2.13	8.8.8.8	0x7ac9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	360	false
Jan 7, 2025 00:51:04.473407030 CET	192.168.2.13	8.8.8.8	0x7ac9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	360	false
Jan 7, 2025 00:51:04.481086016 CET	192.168.2.13	8.8.8.8	0x7ac9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	360	false
Jan 7, 2025 00:51:04.488749027 CET	192.168.2.13	8.8.8.8	0x7ac9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	360	false
Jan 7, 2025 00:51:05.180227041 CET	192.168.2.13	8.8.8.8	0x6ac0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.187760115 CET	192.168.2.13	8.8.8.8	0x6ac0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.194914103 CET	192.168.2.13	8.8.8.8	0x6ac0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.201742887 CET	192.168.2.13	8.8.8.8	0x6ac0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.208848000 CET	192.168.2.13	8.8.8.8	0x6ac0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.910207987 CET	192.168.2.13	8.8.8.8	0xe7d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.917370081 CET	192.168.2.13	8.8.8.8	0xe7d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.924576044 CET	192.168.2.13	8.8.8.8	0xe7d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.931809902 CET	192.168.2.13	8.8.8.8	0xe7d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:05.938832045 CET	192.168.2.13	8.8.8.8	0xe7d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	361	false
Jan 7, 2025 00:51:06.658636093 CET	192.168.2.13	8.8.8.8	0x7aee	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	362	false
Jan 7, 2025 00:51:06.666075945 CET	192.168.2.13	8.8.8.8	0x7aee	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	362	false
Jan 7, 2025 00:51:06.673176050 CET	192.168.2.13	8.8.8.8	0x7aee	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	362	false
Jan 7, 2025 00:51:06.680355072 CET	192.168.2.13	8.8.8.8	0x7aee	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	362	false
Jan 7, 2025 00:51:06.687496901 CET	192.168.2.13	8.8.8.8	0x7aee	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	362	false
Jan 7, 2025 00:51:07.383485079 CET	192.168.2.13	8.8.8.8	0x10d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	363	false
Jan 7, 2025 00:51:07.390414953 CET	192.168.2.13	8.8.8.8	0x10d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	363	false
Jan 7, 2025 00:51:07.397315979 CET	192.168.2.13	8.8.8.8	0x10d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	363	false
Jan 7, 2025 00:51:07.404158115 CET	192.168.2.13	8.8.8.8	0x10d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	363	false
Jan 7, 2025 00:51:07.411325932 CET	192.168.2.13	8.8.8.8	0x10d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	363	false
Jan 7, 2025 00:51:08.094279051 CET	192.168.2.13	8.8.8.8	0x42f2	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.101995945 CET	192.168.2.13	8.8.8.8	0x42f2	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.109359980 CET	192.168.2.13	8.8.8.8	0x42f2	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.116274118 CET	192.168.2.13	8.8.8.8	0x42f2	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.123940945 CET	192.168.2.13	8.8.8.8	0x42f2	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.807833910 CET	192.168.2.13	8.8.8.8	0xbdcc	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.814599037 CET	192.168.2.13	8.8.8.8	0xbdcc	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.821438074 CET	192.168.2.13	8.8.8.8	0xbdcc	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.828260899 CET	192.168.2.13	8.8.8.8	0xbdcc	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:08.835283995 CET	192.168.2.13	8.8.8.8	0xbdcc	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	364	false
Jan 7, 2025 00:51:09.517254114 CET	192.168.2.13	8.8.8.8	0xdd91	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	365	false
Jan 7, 2025 00:51:09.524240017 CET	192.168.2.13	8.8.8.8	0xdd91	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	365	false
Jan 7, 2025 00:51:09.531253099 CET	192.168.2.13	8.8.8.8	0xdd91	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	365	false
Jan 7, 2025 00:51:09.538306952 CET	192.168.2.13	8.8.8.8	0xdd91	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	365	false
Jan 7, 2025 00:51:09.545146942 CET	192.168.2.13	8.8.8.8	0xdd91	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	365	false
Jan 7, 2025 00:51:10.239852905 CET	192.168.2.13	8.8.8.8	0x6e38	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.247308016 CET	192.168.2.13	8.8.8.8	0x6e38	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.254703045 CET	192.168.2.13	8.8.8.8	0x6e38	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.261651993 CET	192.168.2.13	8.8.8.8	0x6e38	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.268683910 CET	192.168.2.13	8.8.8.8	0x6e38	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.941740990 CET	192.168.2.13	8.8.8.8	0xe2a0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.949043989 CET	192.168.2.13	8.8.8.8	0xe2a0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.956192017 CET	192.168.2.13	8.8.8.8	0xe2a0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.963223934 CET	192.168.2.13	8.8.8.8	0xe2a0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:10.970174074 CET	192.168.2.13	8.8.8.8	0xe2a0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	366	false
Jan 7, 2025 00:51:11.663975000 CET	192.168.2.13	8.8.8.8	0xf0d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	367	false
Jan 7, 2025 00:51:11.670958996 CET	192.168.2.13	8.8.8.8	0xf0d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	367	false
Jan 7, 2025 00:51:11.677862883 CET	192.168.2.13	8.8.8.8	0xf0d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	367	false
Jan 7, 2025 00:51:11.684752941 CET	192.168.2.13	8.8.8.8	0xf0d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	367	false
Jan 7, 2025 00:51:11.691692114 CET	192.168.2.13	8.8.8.8	0xf0d0	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	367	false
Jan 7, 2025 00:51:12.390789032 CET	192.168.2.13	8.8.8.8	0x4c2c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	368	false
Jan 7, 2025 00:51:12.397775888 CET	192.168.2.13	8.8.8.8	0x4c2c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	368	false
Jan 7, 2025 00:51:12.404988050 CET	192.168.2.13	8.8.8.8	0x4c2c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	368	false
Jan 7, 2025 00:51:12.411956072 CET	192.168.2.13	8.8.8.8	0x4c2c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	368	false
Jan 7, 2025 00:51:12.419100046 CET	192.168.2.13	8.8.8.8	0x4c2c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	368	false
Jan 7, 2025 00:51:13.109651089 CET	192.168.2.13	8.8.8.8	0xba22	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.116609097 CET	192.168.2.13	8.8.8.8	0xba22	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.123600960 CET	192.168.2.13	8.8.8.8	0xba22	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.130603075 CET	192.168.2.13	8.8.8.8	0xba22	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.137337923 CET	192.168.2.13	8.8.8.8	0xba22	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.818440914 CET	192.168.2.13	8.8.8.8	0xa8b4	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.825282097 CET	192.168.2.13	8.8.8.8	0xa8b4	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.832242012 CET	192.168.2.13	8.8.8.8	0xa8b4	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.839342117 CET	192.168.2.13	8.8.8.8	0xa8b4	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:13.846144915 CET	192.168.2.13	8.8.8.8	0xa8b4	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	369	false
Jan 7, 2025 00:51:14.536747932 CET	192.168.2.13	8.8.8.8	0x310d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	370	false
Jan 7, 2025 00:51:14.543478966 CET	192.168.2.13	8.8.8.8	0x310d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	370	false
Jan 7, 2025 00:51:14.550427914 CET	192.168.2.13	8.8.8.8	0x310d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	370	false
Jan 7, 2025 00:51:14.557456970 CET	192.168.2.13	8.8.8.8	0x310d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	370	false
Jan 7, 2025 00:51:14.564364910 CET	192.168.2.13	8.8.8.8	0x310d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	370	false
Jan 7, 2025 00:51:15.263493061 CET	192.168.2.13	8.8.8.8	0xd1b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:15.270144939 CET	192.168.2.13	8.8.8.8	0xd1b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:15.277054071 CET	192.168.2.13	8.8.8.8	0xd1b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:15.284065962 CET	192.168.2.13	8.8.8.8	0xd1b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:15.290673018 CET	192.168.2.13	8.8.8.8	0xd1b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:15.972589016 CET	192.168.2.13	8.8.8.8	0x97f9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:15.979449034 CET	192.168.2.13	8.8.8.8	0x97f9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:15.986318111 CET	192.168.2.13	8.8.8.8	0x97f9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:15.993228912 CET	192.168.2.13	8.8.8.8	0x97f9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	371	false
Jan 7, 2025 00:51:16.000235081 CET	192.168.2.13	8.8.8.8	0x97f9	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	372	false
Jan 7, 2025 00:51:16.668087959 CET	192.168.2.13	8.8.8.8	0x2a8	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	372	false
Jan 7, 2025 00:51:16.675211906 CET	192.168.2.13	8.8.8.8	0x2a8	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	372	false
Jan 7, 2025 00:51:16.681864023 CET	192.168.2.13	8.8.8.8	0x2a8	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	372	false
Jan 7, 2025 00:51:16.688787937 CET	192.168.2.13	8.8.8.8	0x2a8	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	372	false
Jan 7, 2025 00:51:16.695749044 CET	192.168.2.13	8.8.8.8	0x2a8	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	372	false
Jan 7, 2025 00:51:17.390043974 CET	192.168.2.13	8.8.8.8	0x8b07	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	373	false
Jan 7, 2025 00:51:17.396964073 CET	192.168.2.13	8.8.8.8	0x8b07	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	373	false
Jan 7, 2025 00:51:17.403776884 CET	192.168.2.13	8.8.8.8	0x8b07	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	373	false
Jan 7, 2025 00:51:17.410686970 CET	192.168.2.13	8.8.8.8	0x8b07	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	373	false
Jan 7, 2025 00:51:17.417459965 CET	192.168.2.13	8.8.8.8	0x8b07	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	373	false
Jan 7, 2025 00:51:18.100819111 CET	192.168.2.13	8.8.8.8	0x488e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.107604980 CET	192.168.2.13	8.8.8.8	0x488e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.114527941 CET	192.168.2.13	8.8.8.8	0x488e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.122128010 CET	192.168.2.13	8.8.8.8	0x488e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.130199909 CET	192.168.2.13	8.8.8.8	0x488e	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.826760054 CET	192.168.2.13	8.8.8.8	0x7d3b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.833589077 CET	192.168.2.13	8.8.8.8	0x7d3b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.840564013 CET	192.168.2.13	8.8.8.8	0x7d3b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.847698927 CET	192.168.2.13	8.8.8.8	0x7d3b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:18.854927063 CET	192.168.2.13	8.8.8.8	0x7d3b	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	374	false
Jan 7, 2025 00:51:19.543864965 CET	192.168.2.13	8.8.8.8	0x424c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	375	false
Jan 7, 2025 00:51:19.550559998 CET	192.168.2.13	8.8.8.8	0x424c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	375	false
Jan 7, 2025 00:51:19.557568073 CET	192.168.2.13	8.8.8.8	0x424c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	375	false
Jan 7, 2025 00:51:19.564378023 CET	192.168.2.13	8.8.8.8	0x424c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	375	false
Jan 7, 2025 00:51:19.571069956 CET	192.168.2.13	8.8.8.8	0x424c	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	375	false
Jan 7, 2025 00:51:20.241547108 CET	192.168.2.13	8.8.8.8	0xa76d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	376	false
Jan 7, 2025 00:51:20.248382092 CET	192.168.2.13	8.8.8.8	0xa76d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	376	false
Jan 7, 2025 00:51:20.255306005 CET	192.168.2.13	8.8.8.8	0xa76d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	376	false
Jan 7, 2025 00:51:20.262559891 CET	192.168.2.13	8.8.8.8	0xa76d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	376	false
Jan 7, 2025 00:51:20.269484043 CET	192.168.2.13	8.8.8.8	0xa76d	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	376	false
Jan 7, 2025 00:51:21.045372009 CET	192.168.2.13	8.8.8.8	0xd073	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.052155018 CET	192.168.2.13	8.8.8.8	0xd073	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.059048891 CET	192.168.2.13	8.8.8.8	0xd073	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.065824032 CET	192.168.2.13	8.8.8.8	0xd073	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.072633028 CET	192.168.2.13	8.8.8.8	0xd073	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.754702091 CET	192.168.2.13	8.8.8.8	0x636a	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.761490107 CET	192.168.2.13	8.8.8.8	0x636a	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.768399000 CET	192.168.2.13	8.8.8.8	0x636a	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.775305033 CET	192.168.2.13	8.8.8.8	0x636a	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false
Jan 7, 2025 00:51:21.781960011 CET	192.168.2.13	8.8.8.8	0x636a	Standard query (0)	fingwi.cardiacpure.ru. [malformed]	256	377	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 00:48:51.734155893 CET	8.8.8.8	192.168.2.13	0xbb3	No error (0)	fingwi.cardiacpure.ru	178.215.238.112	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:00.648238897 CET	8.8.8.8	192.168.2.13	0x4482	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:00.648238897 CET	8.8.8.8	192.168.2.13	0x4482	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ngwa5.elf PID: 5722, Parent PID: 5527

General

Start time (UTC):	23:48:50
Start date (UTC):	06/01/2025
Path:	/tmp/ngwa5.elf
Arguments:	/tmp/ngwa5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ngwa5.elf PID: 5724, Parent PID: 5722

General

Start time (UTC):	23:48:50
Start date (UTC):	06/01/2025
Path:	/tmp/ngwa5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ngwa5.elf PID: 5726, Parent PID: 5724

General

Start time (UTC):	23:48:50
Start date (UTC):	06/01/2025
Path:	/tmp/ngwa5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: gnome-session-binary PID: 5728, Parent PID: 1588

General

Start time (UTC):	23:48:51
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 5728, Parent PID: 1588

General

Start time (UTC):	23:48:51
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gsd-rfkill PID: 5728, Parent PID: 1588

General

Start time (UTC):	23:48:51
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Chronological Activities

Analysis Process: systemd PID: 5733, Parent PID: 1

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-hostnamed PID: 5733, Parent PID: 1

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Chronological Activities

Analysis Process: gdm3 PID: 5826, Parent PID: 1400

General

Start time (UTC):	23:48:51
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5826, Parent PID: 1400

General

Start time (UTC):	23:48:51
Start date (UTC):	06/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 5885, Parent PID: 1400

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5885, Parent PID: 1400

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 5886, Parent PID: 1

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5886, Parent PID: 1

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: gvfsd-fuse PID: 5898, Parent PID: 3122

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Chronological Activities

Analysis Process: fusermount PID: 5898, Parent PID: 3122

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/bin/fusermount
Arguments:	fusermount -u -q -z -- /run/user/1000/gvfs
File size:	39144 bytes
MD5 hash:	576a1b135c82bdcbc97a91acea900566

Chronological Activities

Analysis Process: systemd PID: 5899, Parent PID: 1

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5899, Parent PID: 1

General

Start time (UTC):	23:48:52
Start date (UTC):	06/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5903, Parent PID: 1

General

Start time (UTC):	23:48:53
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5903, Parent PID: 1

General

Start time (UTC):	23:48:53
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5905, Parent PID: 1

General

Start time (UTC):	23:48:53
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5905, Parent PID: 1

General

Start time (UTC):	23:48:53
Start date (UTC):	06/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5917, Parent PID: 1

General

Start time (UTC):	23:48:54
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-logind PID: 5917, Parent PID: 1

General

Start time (UTC):	23:48:54
Start date (UTC):	06/01/2025
Path:	/lib/systemd/systemd-logind
Arguments:	/lib/systemd/systemd-logind
File size:	268576 bytes
MD5 hash:	8dd58a1b4c12f7a1d5fe3ce18b2aaeef

Chronological Activities

Analysis Process: systemd PID: 5974, Parent PID: 1

General

Start time (UTC):	23:48:54
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: agetty PID: 5974, Parent PID: 1

General

Start time (UTC):	23:48:54
Start date (UTC):	06/01/2025
Path:	/sbin/agetty
Arguments:	/sbin/agetty -o "-p -- \\u" --noclear tty2 linux
File size:	69000 bytes
MD5 hash:	3a374724ba7e863768139bdd60ca36f7

Chronological Activities

Analysis Process: gdm3 PID: 5975, Parent PID: 1400

General

Start time (UTC):	23:48:54
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5975, Parent PID: 1400

General

Start time (UTC):	23:48:54
Start date (UTC):	06/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 5976, Parent PID: 1

General

Start time (UTC):	23:48:55
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5976, Parent PID: 1

General

Start time (UTC):	23:48:55
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5977, Parent PID: 1

General

Start time (UTC):	23:48:55
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: agetty PID: 5977, Parent PID: 1

General

Start time (UTC):	23:48:55
Start date (UTC):	06/01/2025
Path:	/sbin/agetty
Arguments:	/sbin/agetty -o "-p -- \\u" --noclear tty2 linux
File size:	69000 bytes
MD5 hash:	3a374724ba7e863768139bdd60ca36f7

Chronological Activities

Analysis Process: systemd PID: 5978, Parent PID: 1

General

Start time (UTC):	23:48:55
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5978, Parent PID: 1

General

Start time (UTC):	23:48:55
Start date (UTC):	06/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5979, Parent PID: 1

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 5979, Parent PID: 1

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: gpu-manager PID: 5980, Parent PID: 5979

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 5980, Parent PID: 5979

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5981, Parent PID: 5980

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5981, Parent PID: 5980

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 5985, Parent PID: 5979

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 5985, Parent PID: 5979

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5986, Parent PID: 5985

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5986, Parent PID: 5985

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 5987, Parent PID: 5979

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 5987, Parent PID: 5979

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5988, Parent PID: 5987

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5988, Parent PID: 5987

General

Start time (UTC):	23:48:56
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 5989, Parent PID: 5979

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 5989, Parent PID: 5979

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5990, Parent PID: 5989

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5990, Parent PID: 5989

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6050, Parent PID: 5979

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6050, Parent PID: 5979

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6051, Parent PID: 6050

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6051, Parent PID: 6050

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6055, Parent PID: 5979

General

Start time (UTC):	23:48:58
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6055, Parent PID: 5979

General

Start time (UTC):	23:48:58
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6056, Parent PID: 6055

General

Start time (UTC):	23:48:58
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6056, Parent PID: 6055

General

Start time (UTC):	23:48:58
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6059, Parent PID: 5979

General

Start time (UTC):	23:48:58
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6059, Parent PID: 5979

General

Start time (UTC):	23:48:58
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6062, Parent PID: 6059

General

Start time (UTC):	23:48:58
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6062, Parent PID: 6059

General

Start time (UTC):	23:48:58
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6064, Parent PID: 5979

General

Start time (UTC):	23:48:59
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6064, Parent PID: 5979

General

Start time (UTC):	23:48:59
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6065, Parent PID: 6064

General

Start time (UTC):	23:48:59
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6065, Parent PID: 6064

General

Start time (UTC):	23:48:59
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: systemd PID: 5993, Parent PID: 1

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-logind PID: 5993, Parent PID: 1

General

Start time (UTC):	23:48:57
Start date (UTC):	06/01/2025
Path:	/lib/systemd/systemd-logind
Arguments:	/lib/systemd/systemd-logind
File size:	268576 bytes
MD5 hash:	8dd58a1b4c12f7a1d5fe3ce18b2aaeef

Chronological Activities

Analysis Process: systemd PID: 6067, Parent PID: 1

General

Start time (UTC):	23:49:00
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 6067, Parent PID: 1

General

Start time (UTC):	23:49:00
Start date (UTC):	06/01/2025
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 6068, Parent PID: 6067

General

Start time (UTC):	23:49:00
Start date (UTC):	06/01/2025
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6068, Parent PID: 6067

General

Start time (UTC):	23:49:00
Start date (UTC):	06/01/2025
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 6069, Parent PID: 1

General

Start time (UTC):	23:49:01
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gdm-wait-for-drm PID: 6069, Parent PID: 1

General

Start time (UTC):	23:49:01
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-wait-for-drm
Arguments:	/usr/lib/gdm3/gdm-wait-for-drm
File size:	14640 bytes
MD5 hash:	82043ba752c6930b4e6aaea2f7747545

Chronological Activities

Analysis Process: systemd PID: 6074, Parent PID: 1

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gdm3 PID: 6074, Parent PID: 1

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	/usr/sbin/gdm3
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: gdm3 PID: 6078, Parent PID: 6074

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: plymouth PID: 6078, Parent PID: 6074

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/bin/plymouth
Arguments:	plymouth --ping
File size:	51352 bytes
MD5 hash:	87003efd8dad470042f5e75360a8f49f

Chronological Activities

Analysis Process: gdm3 PID: 6101, Parent PID: 6074

General

Start time (UTC):	23:49:13
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: gdm-session-worker PID: 6101, Parent PID: 6074

General

Start time (UTC):	23:49:13
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	"gdm-session-worker [pam/gdm-launch-environment]"
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Chronological Activities

Analysis Process: gdm-session-worker PID: 6105, Parent PID: 6101

General

Start time (UTC):	23:49:15
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Chronological Activities

Analysis Process: gdm-wayland-session PID: 6105, Parent PID: 6101

General

Start time (UTC):	23:49:15
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	/usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Chronological Activities

Analysis Process: gdm-wayland-session PID: 6111, Parent PID: 6105

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Chronological Activities

Analysis Process: dbus-run-session PID: 6111, Parent PID: 6105

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: dbus-run-session PID: 6112, Parent PID: 6111

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: dbus-daemon PID: 6112, Parent PID: 6111

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --nofork --print-address 4 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6116, Parent PID: 6112

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6117, Parent PID: 6116

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6117, Parent PID: 6116

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6119, Parent PID: 6112

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6120, Parent PID: 6119

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6120, Parent PID: 6119

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6121, Parent PID: 6112

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6122, Parent PID: 6121

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6122, Parent PID: 6121

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6123, Parent PID: 6112

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6124, Parent PID: 6123

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6124, Parent PID: 6123

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6125, Parent PID: 6112

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6126, Parent PID: 6125

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6126, Parent PID: 6125

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6127, Parent PID: 6112

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6128, Parent PID: 6127

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6128, Parent PID: 6127

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6130, Parent PID: 6112

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6131, Parent PID: 6130

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6131, Parent PID: 6130

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-run-session PID: 6113, Parent PID: 6111

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: gnome-session PID: 6113, Parent PID: 6111

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/bin/gnome-session
Arguments:	gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-session-binary PID: 6113, Parent PID: 6111

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	/usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: gnome-session-binary PID: 6132, Parent PID: 6113

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: session-migration PID: 6132, Parent PID: 6113

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/session-migration
Arguments:	session-migration
File size:	22680 bytes
MD5 hash:	5227af42ebf14ac2fe2acddb002f68dc

Chronological Activities

Analysis Process: gnome-session-binary PID: 6133, Parent PID: 6113

General

Start time (UTC):	23:49:18
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 6133, Parent PID: 6113

General

Start time (UTC):	23:49:18
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-shell PID: 6133, Parent PID: 6113

General

Start time (UTC):	23:49:18
Start date (UTC):	06/01/2025
Path:	/usr/bin/gnome-shell
Arguments:	/usr/bin/gnome-shell
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

Chronological Activities

Analysis Process: gdm3 PID: 6149, Parent PID: 6074

General

Start time (UTC):	23:49:20
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: gdm-session-worker PID: 6149, Parent PID: 6074

General

Start time (UTC):	23:49:20
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	"gdm-session-worker [pam/gdm-launch-environment]"
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Chronological Activities

Analysis Process: gdm-session-worker PID: 6154, Parent PID: 6149

General

Start time (UTC):	23:49:21
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Chronological Activities

Analysis Process: gdm-x-session PID: 6154, Parent PID: 6149

General

Start time (UTC):	23:49:22
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	/usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Chronological Activities

Analysis Process: gdm-x-session PID: 6156, Parent PID: 6154

General

Start time (UTC):	23:49:22
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Chronological Activities

Analysis Process: Xorg PID: 6156, Parent PID: 6154

General

Start time (UTC):	23:49:22
Start date (UTC):	06/01/2025
Path:	/usr/bin/Xorg
Arguments:	/usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: Xorg.wrap PID: 6156, Parent PID: 6154

General

Start time (UTC):	23:49:22
Start date (UTC):	06/01/2025
Path:	/usr/lib/xorg/Xorg.wrap
Arguments:	/usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3
File size:	14488 bytes
MD5 hash:	48993830888200ecf19dd7def0884dfd

Chronological Activities

Analysis Process: Xorg PID: 6156, Parent PID: 6154

General

Start time (UTC):	23:49:22
Start date (UTC):	06/01/2025
Path:	/usr/lib/xorg/Xorg
Arguments:	/usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Chronological Activities

Analysis Process: Xorg PID: 6165, Parent PID: 6156

General

Start time (UTC):	23:49:28
Start date (UTC):	06/01/2025
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Chronological Activities

Analysis Process: sh PID: 6165, Parent PID: 6156

General

Start time (UTC):	23:49:28
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6166, Parent PID: 6165

General

Start time (UTC):	23:49:28
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: xkbcomp PID: 6166, Parent PID: 6165

General

Start time (UTC):	23:49:28
Start date (UTC):	06/01/2025
Path:	/usr/bin/xkbcomp
Arguments:	/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm
File size:	217184 bytes
MD5 hash:	c5f953aec4c00d2a1cc27acb75d62c9b

Chronological Activities

Analysis Process: Xorg PID: 6405, Parent PID: 6156

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Chronological Activities

Analysis Process: sh PID: 6405, Parent PID: 6156

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6406, Parent PID: 6405

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: xkbcomp PID: 6406, Parent PID: 6405

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/bin/xkbcomp
Arguments:	/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm
File size:	217184 bytes
MD5 hash:	c5f953aec4c00d2a1cc27acb75d62c9b

Chronological Activities

Analysis Process: gdm-x-session PID: 6169, Parent PID: 6154

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Chronological Activities

Analysis Process: Default PID: 6169, Parent PID: 6154

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/etc/gdm3/Prime/Default
Arguments:	/etc/gdm3/Prime/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm-x-session PID: 6170, Parent PID: 6154

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Chronological Activities

Analysis Process: dbus-run-session PID: 6170, Parent PID: 6154

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: dbus-run-session PID: 6171, Parent PID: 6170

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: dbus-daemon PID: 6171, Parent PID: 6170

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --nofork --print-address 4 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6185, Parent PID: 6171

General

Start time (UTC):	23:49:36
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6186, Parent PID: 6185

General

Start time (UTC):	23:49:36
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: at-spi-bus-launcher PID: 6186, Parent PID: 6185

General

Start time (UTC):	23:49:36
Start date (UTC):	06/01/2025
Path:	/usr/libexec/at-spi-bus-launcher
Arguments:	/usr/libexec/at-spi-bus-launcher
File size:	27008 bytes
MD5 hash:	1563f274acd4e7ba530a55bdc4c95682

Chronological Activities

Analysis Process: at-spi-bus-launcher PID: 6191, Parent PID: 6186

General

Start time (UTC):	23:49:36
Start date (UTC):	06/01/2025
Path:	/usr/libexec/at-spi-bus-launcher
Arguments:	-
File size:	27008 bytes
MD5 hash:	1563f274acd4e7ba530a55bdc4c95682

Chronological Activities

Analysis Process: dbus-daemon PID: 6191, Parent PID: 6186

General

Start time (UTC):	23:49:36
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6566, Parent PID: 6191

General

Start time (UTC):	23:49:50
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6567, Parent PID: 6566

General

Start time (UTC):	23:49:50
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: at-spi2-registryd PID: 6567, Parent PID: 6566

General

Start time (UTC):	23:49:50
Start date (UTC):	06/01/2025
Path:	/usr/libexec/at-spi2-registryd
Arguments:	/usr/libexec/at-spi2-registryd --use-gnome-session
File size:	100224 bytes
MD5 hash:	1d904c2693452edebc7ede3a9e24d440

Chronological Activities

Analysis Process: dbus-daemon PID: 6213, Parent PID: 6171

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6214, Parent PID: 6213

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6214, Parent PID: 6213

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6216, Parent PID: 6171

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6217, Parent PID: 6216

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6217, Parent PID: 6216

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6218, Parent PID: 6171

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6219, Parent PID: 6218

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6219, Parent PID: 6218

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6222, Parent PID: 6171

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6223, Parent PID: 6222

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6223, Parent PID: 6222

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6224, Parent PID: 6171

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6225, Parent PID: 6224

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6225, Parent PID: 6224

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6226, Parent PID: 6171

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6227, Parent PID: 6226

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6227, Parent PID: 6226

General

Start time (UTC):	23:49:38
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6229, Parent PID: 6171

General

Start time (UTC):	23:49:39
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6230, Parent PID: 6229

General

Start time (UTC):	23:49:39
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6230, Parent PID: 6229

General

Start time (UTC):	23:49:39
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-daemon PID: 6407, Parent PID: 6171

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6408, Parent PID: 6407

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: ibus-portal PID: 6408, Parent PID: 6407

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/libexec/ibus-portal
Arguments:	/usr/libexec/ibus-portal
File size:	92536 bytes
MD5 hash:	562ad55bd9a4d54bd7b76746b01e37d3

Chronological Activities

Analysis Process: dbus-daemon PID: 6582, Parent PID: 6171

General

Start time (UTC):	23:49:52
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6583, Parent PID: 6582

General

Start time (UTC):	23:49:52
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: gjs PID: 6583, Parent PID: 6582

General

Start time (UTC):	23:49:52
Start date (UTC):	06/01/2025
Path:	/usr/bin/gjs
Arguments:	/usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications
File size:	23128 bytes
MD5 hash:	5f3eceb792bb65c22f23d1efb4fde3ad

Chronological Activities

Analysis Process: dbus-daemon PID: 6794, Parent PID: 6171

General

Start time (UTC):	23:50:03
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: dbus-daemon PID: 6795, Parent PID: 6794

General

Start time (UTC):	23:50:03
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: false PID: 6795, Parent PID: 6794

General

Start time (UTC):	23:50:03
Start date (UTC):	06/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Chronological Activities

Analysis Process: dbus-run-session PID: 6172, Parent PID: 6170

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Chronological Activities

Analysis Process: gnome-session PID: 6172, Parent PID: 6170

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/usr/bin/gnome-session
Arguments:	gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-session-binary PID: 6172, Parent PID: 6170

General

Start time (UTC):	23:49:32
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	/usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: gnome-session-binary PID: 6173, Parent PID: 6172

General

Start time (UTC):	23:49:33
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: gnome-session-check-accelerated PID: 6173, Parent PID: 6172

General

Start time (UTC):	23:49:33
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-check-accelerated
Arguments:	/usr/libexec/gnome-session-check-accelerated
File size:	18752 bytes
MD5 hash:	a64839518af85b2b9de31aca27646396

Chronological Activities

Analysis Process: gnome-session-check-accelerated PID: 6192, Parent PID: 6173

General

Start time (UTC):	23:49:37
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-check-accelerated
Arguments:	-
File size:	18752 bytes
MD5 hash:	a64839518af85b2b9de31aca27646396

Chronological Activities

Analysis Process: gnome-session-check-accelerated-gl-helper PID: 6192, Parent PID: 6173

General

Start time (UTC):	23:49:37
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-check-accelerated-gl-helper
Arguments:	/usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer
File size:	22920 bytes
MD5 hash:	b1ab9a384f9e98a39ae5c36037dd5e78

Chronological Activities

Analysis Process: gnome-session-check-accelerated PID: 6202, Parent PID: 6173

General

Start time (UTC):	23:49:37
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-check-accelerated
Arguments:	-
File size:	18752 bytes
MD5 hash:	a64839518af85b2b9de31aca27646396

Chronological Activities

Analysis Process: gnome-session-check-accelerated-gles-helper PID: 6202, Parent PID: 6173

General

Start time (UTC):	23:49:37
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-check-accelerated-gles-helper
Arguments:	/usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer
File size:	14728 bytes
MD5 hash:	1bd78885765a18e60c05ed1fb5fa3bf8

Chronological Activities

Analysis Process: gnome-session-binary PID: 6231, Parent PID: 6172

General

Start time (UTC):	23:49:39
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: session-migration PID: 6231, Parent PID: 6172

General

Start time (UTC):	23:49:39
Start date (UTC):	06/01/2025
Path:	/usr/bin/session-migration
Arguments:	session-migration
File size:	22680 bytes
MD5 hash:	5227af42ebf14ac2fe2acddb002f68dc

Chronological Activities

Analysis Process: gnome-session-binary PID: 6232, Parent PID: 6172

General

Start time (UTC):	23:49:39
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 6232, Parent PID: 6172

General

Start time (UTC):	23:49:39
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gnome-shell PID: 6232, Parent PID: 6172

General

Start time (UTC):	23:49:39
Start date (UTC):	06/01/2025
Path:	/usr/bin/gnome-shell
Arguments:	/usr/bin/gnome-shell
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

Chronological Activities

Analysis Process: gnome-shell PID: 6397, Parent PID: 6232

General

Start time (UTC):	23:49:46
Start date (UTC):	06/01/2025
Path:	/usr/bin/gnome-shell
Arguments:	-
File size:	23168 bytes
MD5 hash:	da7a257239677622fe4b3a65972c9e87

Analysis Process: ibus-daemon PID: 6397, Parent PID: 6232

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/bin/ibus-daemon
Arguments:	ibus-daemon --panel disable --xim
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-daemon PID: 6401, Parent PID: 6397

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/bin/ibus-daemon
Arguments:	-
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-memconf PID: 6401, Parent PID: 6397

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/libexec/ibus-memconf
Arguments:	/usr/libexec/ibus-memconf
File size:	22904 bytes
MD5 hash:	523e939905910d06598e66385761a822

Analysis Process: ibus-daemon PID: 6403, Parent PID: 6397

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/bin/ibus-daemon
Arguments:	-
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-daemon PID: 6404, Parent PID: 6403

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/bin/ibus-daemon
Arguments:	-
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-x11 PID: 6404, Parent PID: 1

General

Start time (UTC):	23:49:47
Start date (UTC):	06/01/2025
Path:	/usr/libexec/ibus-x11
Arguments:	/usr/libexec/ibus-x11 --kill-daemon
File size:	100352 bytes
MD5 hash:	2aa1e54666191243814c2733d6992dbd

Analysis Process: ibus-daemon PID: 6626, Parent PID: 6397

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/usr/bin/ibus-daemon
Arguments:	-
File size:	199088 bytes
MD5 hash:	1e00fb9860b198c73f6e364e3ff16f31

Analysis Process: ibus-engine-simple PID: 6626, Parent PID: 6397

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/usr/libexec/ibus-engine-simple
Arguments:	/usr/libexec/ibus-engine-simple
File size:	14712 bytes
MD5 hash:	0238866d5e8802a0ce1b1b9af8cb1376

Analysis Process: gnome-session-binary PID: 6599, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6599, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-sharing PID: 6599, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-sharing
Arguments:	/usr/libexec/gsd-sharing
File size:	35424 bytes
MD5 hash:	e29d9025d98590fbb69f89fdbd4438b3

Analysis Process: gnome-session-binary PID: 6601, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6601, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-wacom PID: 6601, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-wacom
Arguments:	/usr/libexec/gsd-wacom
File size:	39520 bytes
MD5 hash:	13778dd1a23a4e94ddc17ac9caa4fcc1

Analysis Process: gnome-session-binary PID: 6603, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6603, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-color PID: 6603, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-color
Arguments:	/usr/libexec/gsd-color
File size:	92832 bytes
MD5 hash:	ac2861ad93ce047283e8e87cefef9a19

Analysis Process: gnome-session-binary PID: 6604, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6604, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-keyboard PID: 6604, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-keyboard
Arguments:	/usr/libexec/gsd-keyboard
File size:	39760 bytes
MD5 hash:	8e288fd17c80bb0a1148b964b2ac2279

Analysis Process: gnome-session-binary PID: 6605, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6605, Parent PID: 6172

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-print-notifications PID: 6605, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-print-notifications
Arguments:	/usr/libexec/gsd-print-notifications
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Analysis Process: gsd-print-notifications PID: 6637, Parent PID: 6605

General

Start time (UTC):	23:50:01
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-print-notifications
Arguments:	-
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Analysis Process: gsd-print-notifications PID: 6638, Parent PID: 6637

General

Start time (UTC):	23:50:01
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-print-notifications
Arguments:	-
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Analysis Process: gsd-printer PID: 6638, Parent PID: 1

General

Start time (UTC):	23:50:01
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-printer
Arguments:	/usr/libexec/gsd-printer
File size:	31120 bytes
MD5 hash:	7995828cf98c315fd55f2ffb3b22384d

Analysis Process: gnome-session-binary PID: 6607, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6607, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-rfkill PID: 6607, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Analysis Process: gnome-session-binary PID: 6609, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6609, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-smartcard PID: 6609, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-smartcard
Arguments:	/usr/libexec/gsd-smartcard
File size:	109152 bytes
MD5 hash:	ea1fbd7f62e4cd0331eae2ef754ee605

Analysis Process: gnome-session-binary PID: 6610, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6610, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-datetime PID: 6610, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-datetime
Arguments:	/usr/libexec/gsd-datetime
File size:	76736 bytes
MD5 hash:	d80d39745740de37d6634d36e344d4bc

Analysis Process: gnome-session-binary PID: 6611, Parent PID: 6172

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6611, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-media-keys PID: 6611, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-media-keys
Arguments:	/usr/libexec/gsd-media-keys
File size:	232936 bytes
MD5 hash:	a425448c135afb4b8bfd79cc0b6b74da

Analysis Process: gnome-session-binary PID: 6614, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6614, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-screensaver-proxy PID: 6614, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-screensaver-proxy
Arguments:	/usr/libexec/gsd-screensaver-proxy
File size:	27232 bytes
MD5 hash:	77e309450c87dceee43f1a9e50cc0d02

Analysis Process: gnome-session-binary PID: 6616, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6616, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-sound PID: 6616, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-sound
Arguments:	/usr/libexec/gsd-sound
File size:	31248 bytes
MD5 hash:	4c7d3fb993463337b4a0eb5c80c760ee

Analysis Process: gnome-session-binary PID: 6620, Parent PID: 6172

General

Start time (UTC):	23:49:58
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6620, Parent PID: 6172

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-a11y-settings PID: 6620, Parent PID: 6172

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-a11y-settings
Arguments:	/usr/libexec/gsd-a11y-settings
File size:	23056 bytes
MD5 hash:	18e243d2cf30ecee7ea89d1462725c5c

Analysis Process: gnome-session-binary PID: 6624, Parent PID: 6172

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6624, Parent PID: 6172

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-housekeeping PID: 6624, Parent PID: 6172

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Analysis Process: gnome-session-binary PID: 6625, Parent PID: 6172

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6625, Parent PID: 6172

General

Start time (UTC):	23:49:59
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gsd-power PID: 6625, Parent PID: 6172

General

Start time (UTC):	23:50:00
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-power
Arguments:	/usr/libexec/gsd-power
File size:	88672 bytes
MD5 hash:	28b8e1b43c3e7f1db6741ea1ecd978b7

Analysis Process: gnome-session-binary PID: 6860, Parent PID: 6172

General

Start time (UTC):	23:50:16
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6860, Parent PID: 6172

General

Start time (UTC):	23:50:16
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: spice-vdagent PID: 6860, Parent PID: 6172

General

Start time (UTC):	23:50:16
Start date (UTC):	06/01/2025
Path:	/usr/bin/spice-vdagent
Arguments:	/usr/bin/spice-vdagent
File size:	80664 bytes
MD5 hash:	80fb7f613aa78d1b8a229dbcf4577a9d

Analysis Process: gnome-session-binary PID: 6911, Parent PID: 6172

General

Start time (UTC):	23:50:19
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Analysis Process: sh PID: 6911, Parent PID: 6172

General

Start time (UTC):	23:50:19
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: xbrlapi PID: 6911, Parent PID: 6172

General

Start time (UTC):	23:50:20
Start date (UTC):	06/01/2025
Path:	/usr/bin/xbrlapi
Arguments:	xbrlapi -q
File size:	166384 bytes
MD5 hash:	0cfe25df39d38af32d6265ed947ca5b9

Analysis Process: gdm3 PID: 6150, Parent PID: 6074

General

Start time (UTC):	23:49:20
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Analysis Process: Default PID: 6150, Parent PID: 6074

General

Start time (UTC):	23:49:20
Start date (UTC):	06/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: gdm3 PID: 6151, Parent PID: 6074

General

Start time (UTC):	23:49:20
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Analysis Process: Default PID: 6151, Parent PID: 6074

General

Start time (UTC):	23:49:20
Start date (UTC):	06/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: systemd PID: 6080, Parent PID: 1

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: accounts-daemon PID: 6080, Parent PID: 1

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	/usr/lib/accountsservice/accounts-daemon
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Analysis Process: accounts-daemon PID: 6090, Parent PID: 6080

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	-
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Analysis Process: language-validate PID: 6090, Parent PID: 6080

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/share/language-tools/language-validate
Arguments:	/usr/share/language-tools/language-validate en_US.UTF-8
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: language-validate PID: 6091, Parent PID: 6090

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/share/language-tools/language-validate
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: language-options PID: 6091, Parent PID: 6090

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/share/language-tools/language-options
Arguments:	/usr/share/language-tools/language-options
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Analysis Process: language-options PID: 6092, Parent PID: 6091

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/share/language-tools/language-options
Arguments:	-
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Analysis Process: sh PID: 6092, Parent PID: 6091

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "locale -a \| grep -F .utf8 "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6093, Parent PID: 6092

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: locale PID: 6093, Parent PID: 6092

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/bin/locale
Arguments:	locale -a
File size:	58944 bytes
MD5 hash:	c72a78792469db86d91369c9057f20d2

Analysis Process: sh PID: 6094, Parent PID: 6092

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: grep PID: 6094, Parent PID: 6092

General

Start time (UTC):	23:49:12
Start date (UTC):	06/01/2025
Path:	/usr/bin/grep
Arguments:	grep -F .utf8
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Analysis Process: systemd PID: 6095, Parent PID: 1

General

Start time (UTC):	23:49:13
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: polkitd PID: 6095, Parent PID: 1

General

Start time (UTC):	23:49:13
Start date (UTC):	06/01/2025
Path:	/usr/lib/policykit-1/polkitd
Arguments:	/usr/lib/policykit-1/polkitd --no-debug
File size:	121504 bytes
MD5 hash:	8efc9b4b5b524210ad2ea1954a9d0e69

Analysis Process: systemd PID: 6109, Parent PID: 1410

General

Start time (UTC):	23:49:15
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: dbus-daemon PID: 6109, Parent PID: 1410

General

Start time (UTC):	23:49:15
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Analysis Process: systemd PID: 6252, Parent PID: 1

General

Start time (UTC):	23:49:46
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: systemd-localed PID: 6252, Parent PID: 1

General

Start time (UTC):	23:49:46
Start date (UTC):	06/01/2025
Path:	/lib/systemd/systemd-localed
Arguments:	/lib/systemd/systemd-localed
File size:	43232 bytes
MD5 hash:	1244af9646256d49594f2a8203329aa9

Analysis Process: systemd PID: 6417, Parent PID: 1

General

Start time (UTC):	23:49:49
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: upowerd PID: 6417, Parent PID: 1

General

Start time (UTC):	23:49:49
Start date (UTC):	06/01/2025
Path:	/usr/lib/upower/upowerd
Arguments:	/usr/lib/upower/upowerd
File size:	260328 bytes
MD5 hash:	1253eea2fe5fe4017069664284e326cd

Analysis Process: systemd PID: 6455, Parent PID: 1410

General

Start time (UTC):	23:49:49
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: pulseaudio PID: 6455, Parent PID: 1410

General

Start time (UTC):	23:49:49
Start date (UTC):	06/01/2025
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Analysis Process: systemd PID: 6458, Parent PID: 1

General

Start time (UTC):	23:49:49
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: geoclue PID: 6458, Parent PID: 1

General

Start time (UTC):	23:49:49
Start date (UTC):	06/01/2025
Path:	/usr/libexec/geoclue
Arguments:	/usr/libexec/geoclue
File size:	301544 bytes
MD5 hash:	30ac5455f3c598dde91dc87477fb19f7

Analysis Process: systemd PID: 6564, Parent PID: 1

General

Start time (UTC):	23:49:50
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: rtkit-daemon PID: 6564, Parent PID: 1

General

Start time (UTC):	23:49:50
Start date (UTC):	06/01/2025
Path:	/usr/libexec/rtkit-daemon
Arguments:	/usr/libexec/rtkit-daemon
File size:	68096 bytes
MD5 hash:	df0cacf1db4ec95ac70f5b6e06b8ffd7

Analysis Process: systemd PID: 6576, Parent PID: 1

General

Start time (UTC):	23:49:51
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: wpa_supplicant PID: 6576, Parent PID: 1

General

Start time (UTC):	23:49:51
Start date (UTC):	06/01/2025
Path:	/sbin/wpa_supplicant
Arguments:	/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
File size:	2893136 bytes
MD5 hash:	2a5acf2a7a908a1388a09991ed7881e1

Analysis Process: systemd PID: 6577, Parent PID: 1

General

Start time (UTC):	23:49:51
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: avahi-daemon PID: 6577, Parent PID: 1

General

Start time (UTC):	23:49:51
Start date (UTC):	06/01/2025
Path:	/usr/sbin/avahi-daemon
Arguments:	/usr/sbin/avahi-daemon -s
File size:	141832 bytes
MD5 hash:	0125e88392fec809934928f8638511ff

Analysis Process: avahi-daemon PID: 6579, Parent PID: 6577

General

Start time (UTC):	23:49:52
Start date (UTC):	06/01/2025
Path:	/usr/sbin/avahi-daemon
Arguments:	-
File size:	141832 bytes
MD5 hash:	0125e88392fec809934928f8638511ff

Analysis Process: systemd PID: 6580, Parent PID: 1

General

Start time (UTC):	23:49:52
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: packagekitd PID: 6580, Parent PID: 1

General

Start time (UTC):	23:49:52
Start date (UTC):	06/01/2025
Path:	/usr/lib/packagekit/packagekitd
Arguments:	/usr/lib/packagekit/packagekitd
File size:	289288 bytes
MD5 hash:	46b0c31f013b71a0eb63b1c040f11c86

Analysis Process: packagekitd PID: 6606, Parent PID: 6580

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/usr/lib/packagekit/packagekitd
Arguments:	-
File size:	289288 bytes
MD5 hash:	46b0c31f013b71a0eb63b1c040f11c86

Analysis Process: dpkg PID: 6606, Parent PID: 6580

General

Start time (UTC):	23:49:57
Start date (UTC):	06/01/2025
Path:	/usr/bin/dpkg
Arguments:	/usr/bin/dpkg --print-foreign-architectures
File size:	309944 bytes
MD5 hash:	5e18156b434fc45062eec2f28b9147be

Analysis Process: systemd PID: 6641, Parent PID: 1

General

Start time (UTC):	23:50:02
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: systemd-hostnamed PID: 6641, Parent PID: 1

General

Start time (UTC):	23:50:02
Start date (UTC):	06/01/2025
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Analysis Process: systemd PID: 6832, Parent PID: 1

General

Start time (UTC):	23:50:09
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: colord PID: 6832, Parent PID: 1

General

Start time (UTC):	23:50:09
Start date (UTC):	06/01/2025
Path:	/usr/libexec/colord
Arguments:	/usr/libexec/colord
File size:	346632 bytes
MD5 hash:	70861d1b2818c9279cd4a5c9035dac1f

Analysis Process: colord PID: 6909, Parent PID: 6832

General

Start time (UTC):	23:50:18
Start date (UTC):	06/01/2025
Path:	/usr/libexec/colord
Arguments:	-
File size:	346632 bytes
MD5 hash:	70861d1b2818c9279cd4a5c9035dac1f

Analysis Process: colord-sane PID: 6909, Parent PID: 6832

General

Start time (UTC):	23:50:18
Start date (UTC):	06/01/2025
Path:	/usr/libexec/colord-sane
Arguments:	/usr/libexec/colord-sane
File size:	18736 bytes
MD5 hash:	5f98d754a07bf1385c3ff001cde3882e

Analysis Process: systemd PID: 6863, Parent PID: 1

General

Start time (UTC):	23:50:18
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: ModemManager PID: 6863, Parent PID: 1

General

Start time (UTC):	23:50:18
Start date (UTC):	06/01/2025
Path:	/usr/sbin/ModemManager
Arguments:	/usr/sbin/ModemManager --filter-policy=strict
File size:	1588448 bytes
MD5 hash:	24379bf705a8ff3b2379314585843d4f

Analysis Process: systemd PID: 6928, Parent PID: 1

General

Start time (UTC):	23:50:22
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: fprintd PID: 6928, Parent PID: 1

General

Start time (UTC):	23:50:22
Start date (UTC):	06/01/2025
Path:	/usr/libexec/fprintd
Arguments:	/usr/libexec/fprintd
File size:	125312 bytes
MD5 hash:	b0d8829f05cd028529b84b061b660e84

Analysis Process: systemd PID: 7034, Parent PID: 2935

General

Start time (UTC):	23:50:23
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: dbus-daemon PID: 7034, Parent PID: 2935

General

Start time (UTC):	23:50:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Analysis Process: systemd PID: 7035, Parent PID: 2935

General

Start time (UTC):	23:50:23
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: pulseaudio PID: 7035, Parent PID: 2935

General

Start time (UTC):	23:50:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ngwa5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6117/oom_score_adj

/proc/6120/oom_score_adj

/proc/6122/oom_score_adj

/proc/6124/oom_score_adj

/proc/6126/oom_score_adj

/proc/6128/oom_score_adj

/proc/6131/oom_score_adj

/proc/6186/oom_score_adj

/proc/6214/oom_score_adj

/proc/6217/oom_score_adj

/proc/6219/oom_score_adj

/proc/6223/oom_score_adj

/proc/6225/oom_score_adj

/proc/6227/oom_score_adj

/proc/6230/oom_score_adj

/proc/6408/oom_score_adj

/proc/6567/oom_score_adj

/proc/6583/oom_score_adj

/proc/6795/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1H9RXHk

/run/systemd/inhibit/.#2zEXLVl

/run/systemd/inhibit/.#34VAxil

/run/systemd/inhibit/.#4Q5PsOo

/run/systemd/inhibit/.#5rVLxwn

/run/systemd/seats/.#seat02LEPUo

/run/systemd/seats/.#seat04Gz6Wl

/run/systemd/seats/.#seat0B1VB5m

Linux Analysis Report
ngwa5.elf