Edit tour

Linux Analysis Report
loki.arc.elf

Overview

General Information

Sample name:loki.arc.elf
Analysis ID:1594482
MD5:600c9e7b79068b2c3840d318c33268aa
SHA1:7b440397f101cc759c8f76d3ebf179645e7dd2a8
SHA256:c0379c087d382cc44d4b7bb672535e8e1c4cbc36795cb0631f68aad5f2501cfc
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1594482
Start date and time:2025-01-19 03:00:26 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 43s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:loki.arc.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
  • Max analysis timeout: 600s exceeded, the analysis took too long
Command:/tmp/loki.arc.elf
PID:6265
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 6251, Parent: 4339)
  • rm (PID: 6251, Parent: 4339, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.b8ULcQpYaD /tmp/tmp.s2J351fQg8 /tmp/tmp.ZhBY5jZojY
  • dash New Fork (PID: 6254, Parent: 4339)
  • rm (PID: 6254, Parent: 4339, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.b8ULcQpYaD /tmp/tmp.s2J351fQg8 /tmp/tmp.ZhBY5jZojY
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: loki.arc.elfVirustotal: Detection: 11%Perma Link
Source: loki.arc.elfReversingLabs: Detection: 15%
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 6251)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.b8ULcQpYaD /tmp/tmp.s2J351fQg8 /tmp/tmp.ZhBY5jZojYJump to behavior
Source: /usr/bin/dash (PID: 6254)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.b8ULcQpYaD /tmp/tmp.s2J351fQg8 /tmp/tmp.ZhBY5jZojYJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1594482 Sample: loki.arc.elf Startdate: 19/01/2025 Architecture: LINUX Score: 48 10 109.202.202.202, 80 INIT7CH Switzerland 2->10 12 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->12 14 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->14 16 Multi AV Scanner detection for submitted file 2->16 6 dash rm 2->6         started        8 dash rm 2->8         started        signatures3 process4

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
loki.arc.elf11%VirustotalBrowse
loki.arc.elf16%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
109.202.202.202
unknownSwitzerland
13030INIT7CHfalse
91.189.91.43
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
91.189.91.42
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
  • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43Kloki.arm5.elfGet hashmaliciousUnknownBrowse
    Kloki.arm7.elfGet hashmaliciousMiraiBrowse
      arm7.elfGet hashmaliciousUnknownBrowse
        ppc.elfGet hashmaliciousUnknownBrowse
          arm.elfGet hashmaliciousUnknownBrowse
            mips.elfGet hashmaliciousUnknownBrowse
              arm6.elfGet hashmaliciousUnknownBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    bin.sh.elfGet hashmaliciousMiraiBrowse
                      91.189.91.42Kloki.arm5.elfGet hashmaliciousUnknownBrowse
                        Kloki.arm7.elfGet hashmaliciousMiraiBrowse
                          arm7.elfGet hashmaliciousUnknownBrowse
                            ppc.elfGet hashmaliciousUnknownBrowse
                              arm.elfGet hashmaliciousUnknownBrowse
                                mips.elfGet hashmaliciousUnknownBrowse
                                  arm6.elfGet hashmaliciousUnknownBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        bin.sh.elfGet hashmaliciousMiraiBrowse
                                          No context
                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          CANONICAL-ASGBloki.sh4.elfGet hashmaliciousUnknownBrowse
                                          • 185.125.190.26
                                          loki.m68k.elfGet hashmaliciousUnknownBrowse
                                          • 185.125.190.26
                                          Kloki.arm5.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          Kloki.arm7.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          arm7.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          ppc.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          arm.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          arm6.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          CANONICAL-ASGBloki.sh4.elfGet hashmaliciousUnknownBrowse
                                          • 185.125.190.26
                                          loki.m68k.elfGet hashmaliciousUnknownBrowse
                                          • 185.125.190.26
                                          Kloki.arm5.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          Kloki.arm7.elfGet hashmaliciousMiraiBrowse
                                          • 91.189.91.42
                                          arm7.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          ppc.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          arm.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          arm6.elfGet hashmaliciousUnknownBrowse
                                          • 91.189.91.42
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 91.189.91.42
                                          INIT7CHKloki.arm7.elfGet hashmaliciousMiraiBrowse
                                          • 109.202.202.202
                                          arm7.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          ppc.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          arm.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          mips.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          arm6.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          na.elfGet hashmaliciousPrometeiBrowse
                                          • 109.202.202.202
                                          bin.sh.elfGet hashmaliciousMiraiBrowse
                                          • 109.202.202.202
                                          sshd.elfGet hashmaliciousUnknownBrowse
                                          • 109.202.202.202
                                          No context
                                          No context
                                          No created / dropped files found
                                          File type:ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, for GNU/Linux 4.8.0, stripped
                                          Entropy (8bit):6.285962091569636
                                          TrID:
                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                          File name:loki.arc.elf
                                          File size:42'592 bytes
                                          MD5:600c9e7b79068b2c3840d318c33268aa
                                          SHA1:7b440397f101cc759c8f76d3ebf179645e7dd2a8
                                          SHA256:c0379c087d382cc44d4b7bb672535e8e1c4cbc36795cb0631f68aad5f2501cfc
                                          SHA512:7eb7b502cfa81b9f94b0fce9f9aeb259d535fae7b4d6560d5331622fc9a76e3f3e821f1faf80458873ae0b2e988e2d2bd20775fa7f6cbeb1db98a9b1308f50da
                                          SSDEEP:768:L2v0ZO8d01JTrj58wibUtZD0xKbYHXm1ybdW93:amd0LSULoxKKXmNx
                                          TLSH:9113F7750945F3ACE9F51078F44321E929920B0C3BDCE2C36193467AFFB4B487996E2A
                                          File Content Preview:.ELF..............].........4...........4. ...(.........4...4...4.......................4...4...4................................................ ......D...D...D................ ......T...T...T.......................H...H...H... ... ...........Q.td.......

                                          ELF header

                                          Class:ELF32
                                          Data:2's complement, little endian
                                          Version:1 (current)
                                          Machine:<unknown>
                                          Version Number:0x1
                                          Type:EXEC (Executable file)
                                          OS/ABI:UNIX - System V
                                          ABI Version:0
                                          Entry Point Address:0x10df0
                                          Flags:0x403
                                          ELF Header Size:52
                                          Program Header Offset:52
                                          Program Header Size:32
                                          Number of Program Headers:8
                                          Section Header Offset:41712
                                          Section Header Size:40
                                          Number of Section Headers:22
                                          Header String Table Index:21
                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                          NULL0x00x00x00x00x0000
                                          .interpPROGBITS0x101340x1340x140x00x2A001
                                          .note.ABI-tagNOTE0x101480x1480x200x00x2A004
                                          .hashHASH0x101680x1680x18c0x40x2A404
                                          .dynsymDYNSYM0x102f40x2f40x3c00x100x2A514
                                          .dynstrSTRTAB0x106b40x6b40x1bd0x00x2A001
                                          .rela.pltRELA0x108740x8740x2a00xc0x42AI4164
                                          .initPROGBITS0x10b140xb140x220x00x6AX001
                                          .pltPROGBITS0x10b380xb380x2b80x00x6AX004
                                          .textPROGBITS0x10df00xdf00x8be00x00x6AX004
                                          .finiPROGBITS0x199d00x99d00x160x00x6AX001
                                          .rodataPROGBITS0x199e80x99e80x2180x00x2A004
                                          .eh_framePROGBITS0x19c000x9c000x40x00x2A004
                                          .ctorsPROGBITS0x1bf440x9f440x80x00x3WA004
                                          .dtorsPROGBITS0x1bf4c0x9f4c0x80x00x3WA004
                                          .dynamicDYNAMIC0x1bf540x9f540xa80x80x3WA504
                                          .got.pltPROGBITS0x1bffc0x9ffc0xec0x00x3WA004
                                          .dataPROGBITS0x1c0e80xa0e80xec0x00x3WA004
                                          .bssNOBITS0x1c1d40xa1d40x740x00x3WA004
                                          .commentPROGBITS0x00xa1d40x430x10x30MS001
                                          .ARC.attributes<unknown>0x00xa2170x300x00x0001
                                          .shstrtabSTRTAB0x00xa2470xa90x00x0001
                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                          PHDR0x340x100340x100340x1000x1002.40430x5R E0x4
                                          INTERP0x1340x101340x101340x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                                          LOAD0x00x100000x100000x9c040x9c046.39320x5R E0x2000.interp .note.ABI-tag .hash .dynsym .dynstr .rela.plt .init .plt .text .fini .rodata .eh_frame
                                          LOAD0x9f440x1bf440x1bf440x2900x3043.60790x6RW 0x2000.ctors .dtors .dynamic .got.plt .data .bss
                                          DYNAMIC0x9f540x1bf540x1bf540xa80xa82.07480x6RW 0x4.dynamic
                                          NOTE0x1480x101480x101480x200x201.49880x4R 0x4.note.ABI-tag
                                          GNU_STACK0x00x00x00x00x00.00000x6RW 0x10
                                          GNU_RELRO0x9f440x1bf440x1bf440xbc0xbc2.24580x4R 0x1.ctors .dtors .dynamic
                                          TypeMetaValueTag
                                          DT_NEEDEDsharedliblibc.so.00x1
                                          DT_INITvalue0x10b180xc
                                          DT_FINIvalue0x199d40xd
                                          DT_HASHvalue0x101680x4
                                          DT_STRTABvalue0x106b40x5
                                          DT_SYMTABvalue0x102f40x6
                                          DT_STRSZbytes4450xa
                                          DT_SYMENTbytes160xb
                                          DT_INITvalue0x10b180xc
                                          DT_FINIvalue0x199d40xd
                                          DT_DEBUGvalue0x00x15
                                          DT_PLTGOTvalue0x10b380x3
                                          DT_PLTRELSZbytes6720x2
                                          DT_PLTRELpltrelDT_RELA0x14
                                          DT_JMPRELvalue0x108740x17
                                          DT_NULLvalue0x00x0
                                          NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                          .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                          __bss_start.dynsym0x1c1d40NOTYPE<unknown>DEFAULT18
                                          __errno_location.dynsym0x10d600FUNC<unknown>DEFAULTSHN_UNDEF
                                          __uClibc_main.dynsym0x10cf40FUNC<unknown>DEFAULTSHN_UNDEF
                                          _edata.dynsym0x1c1d40NOTYPE<unknown>DEFAULT17
                                          _end.dynsym0x1c2480NOTYPE<unknown>DEFAULT18
                                          accept.dynsym0x10c100FUNC<unknown>DEFAULTSHN_UNDEF
                                          bind.dynsym0x10c4c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          calloc.dynsym0x10c280FUNC<unknown>DEFAULTSHN_UNDEF
                                          chdir.dynsym0x10c700FUNC<unknown>DEFAULTSHN_UNDEF
                                          clock.dynsym0x10d900FUNC<unknown>DEFAULTSHN_UNDEF
                                          close.dynsym0x10dc00FUNC<unknown>DEFAULTSHN_UNDEF
                                          closedir.dynsym0x10da80FUNC<unknown>DEFAULTSHN_UNDEF
                                          connect.dynsym0x10b680FUNC<unknown>DEFAULTSHN_UNDEF
                                          exit.dynsym0x10d6c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          fcntl.dynsym0x10db40FUNC<unknown>DEFAULTSHN_UNDEF
                                          fork.dynsym0x10ce80FUNC<unknown>DEFAULTSHN_UNDEF
                                          free.dynsym0x10dcc0FUNC<unknown>DEFAULTSHN_UNDEF
                                          getpid.dynsym0x10b800FUNC<unknown>DEFAULTSHN_UNDEF
                                          getppid.dynsym0x10d240FUNC<unknown>DEFAULTSHN_UNDEF
                                          getsockname.dynsym0x10de40FUNC<unknown>DEFAULTSHN_UNDEF
                                          getsockopt.dynsym0x10d480FUNC<unknown>DEFAULTSHN_UNDEF
                                          htonl.dynsym0x10cb80FUNC<unknown>DEFAULTSHN_UNDEF
                                          htons.dynsym0x10d540FUNC<unknown>DEFAULTSHN_UNDEF
                                          inet_addr.dynsym0x10c580FUNC<unknown>DEFAULTSHN_UNDEF
                                          ioctl.dynsym0x10b500FUNC<unknown>DEFAULTSHN_UNDEF
                                          kill.dynsym0x10c400FUNC<unknown>DEFAULTSHN_UNDEF
                                          listen.dynsym0x10cdc0FUNC<unknown>DEFAULTSHN_UNDEF
                                          malloc.dynsym0x10bb00FUNC<unknown>DEFAULTSHN_UNDEF
                                          memcpy.dynsym0x10b980FUNC<unknown>DEFAULTSHN_UNDEF
                                          memset.dynsym0x10d000FUNC<unknown>DEFAULTSHN_UNDEF
                                          ntohl.dynsym0x10c640FUNC<unknown>DEFAULTSHN_UNDEF
                                          ntohs.dynsym0x10d180FUNC<unknown>DEFAULTSHN_UNDEF
                                          open.dynsym0x10d840FUNC<unknown>DEFAULTSHN_UNDEF
                                          opendir.dynsym0x10d3c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          prctl.dynsym0x10b8c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          rand.dynsym0x10c880FUNC<unknown>DEFAULTSHN_UNDEF
                                          read.dynsym0x10ca00FUNC<unknown>DEFAULTSHN_UNDEF
                                          readdir.dynsym0x10bec0FUNC<unknown>DEFAULTSHN_UNDEF
                                          readlink.dynsym0x10ba40FUNC<unknown>DEFAULTSHN_UNDEF
                                          realloc.dynsym0x10cd00FUNC<unknown>DEFAULTSHN_UNDEF
                                          recv.dynsym0x10b5c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          recvfrom.dynsym0x10bc80FUNC<unknown>DEFAULTSHN_UNDEF
                                          rename.dynsym0x10c1c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          select.dynsym0x10be00FUNC<unknown>DEFAULTSHN_UNDEF
                                          send.dynsym0x10c040FUNC<unknown>DEFAULTSHN_UNDEF
                                          sendto.dynsym0x10cc40FUNC<unknown>DEFAULTSHN_UNDEF
                                          setsid.dynsym0x10d9c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          setsockopt.dynsym0x10c7c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          sigaddset.dynsym0x10bf80FUNC<unknown>DEFAULTSHN_UNDEF
                                          sigemptyset.dynsym0x10b740FUNC<unknown>DEFAULTSHN_UNDEF
                                          signal.dynsym0x10c940FUNC<unknown>DEFAULTSHN_UNDEF
                                          sigprocmask.dynsym0x10dd80FUNC<unknown>DEFAULTSHN_UNDEF
                                          sleep.dynsym0x10bbc0FUNC<unknown>DEFAULTSHN_UNDEF
                                          socket.dynsym0x10bd40FUNC<unknown>DEFAULTSHN_UNDEF
                                          srand.dynsym0x10d0c0FUNC<unknown>DEFAULTSHN_UNDEF
                                          strlen.dynsym0x10d780FUNC<unknown>DEFAULTSHN_UNDEF
                                          strncpy.dynsym0x10cac0FUNC<unknown>DEFAULTSHN_UNDEF
                                          time.dynsym0x10d300FUNC<unknown>DEFAULTSHN_UNDEF
                                          write.dynsym0x10c340FUNC<unknown>DEFAULTSHN_UNDEF

                                          Download Network PCAP: filteredfull

                                          • Total Packets: 6
                                          • 443 (HTTPS)
                                          • 80 (HTTP)
                                          TimestampSource PortDest PortSource IPDest IP
                                          Jan 19, 2025 03:01:32.762564898 CET43928443192.168.2.2391.189.91.42
                                          Jan 19, 2025 03:01:38.393851042 CET42836443192.168.2.2391.189.91.43
                                          Jan 19, 2025 03:01:54.263664007 CET43928443192.168.2.2391.189.91.42
                                          Jan 19, 2025 03:01:58.359086037 CET4251680192.168.2.23109.202.202.202
                                          Jan 19, 2025 03:02:04.502263069 CET42836443192.168.2.2391.189.91.43
                                          Jan 19, 2025 03:02:35.217896938 CET43928443192.168.2.2391.189.91.42

                                          System Behavior

                                          Start time (UTC):02:01:25
                                          Start date (UTC):19/01/2025
                                          Path:/usr/bin/dash
                                          Arguments:-
                                          File size:129816 bytes
                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                          Start time (UTC):02:01:25
                                          Start date (UTC):19/01/2025
                                          Path:/usr/bin/rm
                                          Arguments:rm -f /tmp/tmp.b8ULcQpYaD /tmp/tmp.s2J351fQg8 /tmp/tmp.ZhBY5jZojY
                                          File size:72056 bytes
                                          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                          Start time (UTC):02:01:25
                                          Start date (UTC):19/01/2025
                                          Path:/usr/bin/dash
                                          Arguments:-
                                          File size:129816 bytes
                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                          Start time (UTC):02:01:25
                                          Start date (UTC):19/01/2025
                                          Path:/usr/bin/rm
                                          Arguments:rm -f /tmp/tmp.b8ULcQpYaD /tmp/tmp.s2J351fQg8 /tmp/tmp.ZhBY5jZojY
                                          File size:72056 bytes
                                          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b