Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
Nyx4r.arm5.elf

Overview

General Information

Sample name:Nyx4r.arm5.elf
Analysis ID:1644241
MD5:b30829bfc63b8ba3233ce7e2f245e92e
SHA1:e6830c8fb0f8d7776332db39359cf712af33fe49
SHA256:30540730152bea3d2aa46670528ce8f842b33e403cfbc557a21d880a1fb757c0
Tags:elfuser-abuse_ch
Infos:

Detection

Okiru
Score:64
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Okiru
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644241
Start date and time:2025-03-20 13:31:56 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 24s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Nyx4r.arm5.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample

Runtime Messages

Command:/tmp/Nyx4r.arm5.elf
PID:5443
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory

Process Tree

  • system is lnxubuntu20
  • Nyx4r.arm5.elf (PID: 5443, Parent: 5356, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Nyx4r.arm5.elf
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
Nyx4r.arm5.elfJoeSecurity_OkiruYara detected OkiruJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5443.1.00007f5e8c017000.00007f5e8c024000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: Nyx4r.arm5.elf PID: 5443JoeSecurity_OkiruYara detected OkiruJoe Security

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        • • AV Detection
        • • Networking
        • • System Summary
        • • Malware Analysis System Evasion
        • • Stealing of Sensitive Information
        • • Remote Access Functionality

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: Nyx4r.arm5.elfAvira: detected
        Source: Nyx4r.arm5.elfVirustotal: Detection: 56%Perma Link
        Source: Nyx4r.arm5.elfReversingLabs: Detection: 61%
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/SofiasshdbashhttpdtelnetddropbearropbearencodersystemNyx4ar/root/dvr_gui//root/dvr_app//anko-app//opt/157.245.200.182
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal64.troj.linELF@0/0@2/0
        Source: /tmp/Nyx4r.arm5.elf (PID: 5443)Queries kernel information via 'uname': Jump to behavior
        Source: Nyx4r.arm5.elf, 5443.1.00007fffb8f53000.00007fffb8f74000.rw-.sdmpBinary or memory string: qemu: %s: %s
        Source: Nyx4r.arm5.elf, 5443.1.00007fffb8f53000.00007fffb8f74000.rw-.sdmpBinary or memory string: leqemu: %s: %s
        Source: Nyx4r.arm5.elf, 5443.1.0000556183f02000.0000556184030000.rw-.sdmpBinary or memory string: aUrg.qemu.gdb.arm.sys.regs">
        Source: Nyx4r.arm5.elf, 5443.1.0000556183f02000.0000556184030000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: Nyx4r.arm5.elf, 5443.1.00007fffb8f53000.00007fffb8f74000.rw-.sdmpBinary or memory string: `x86_64/usr/bin/qemu-arm/tmp/Nyx4r.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Nyx4r.arm5.elf
        Source: Nyx4r.arm5.elf, 5443.1.00007fffb8f53000.00007fffb8f74000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: Nyx4r.arm5.elf, 5443.1.0000556183f02000.0000556184030000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">
        Source: Nyx4r.arm5.elf, 5443.1.0000556183f02000.0000556184030000.rw-.sdmpBinary or memory string: aU!/etc/qemu-binfmt/arm

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: Nyx4r.arm5.elf, type: SAMPLE
        Source: Yara matchFile source: 5443.1.00007f5e8c017000.00007f5e8c024000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Nyx4r.arm5.elf PID: 5443, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: Nyx4r.arm5.elf, type: SAMPLE
        Source: Yara matchFile source: 5443.1.00007f5e8c017000.00007f5e8c024000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Nyx4r.arm5.elf PID: 5443, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
        Security Software Discovery        		Remote ServicesData from Local System1
        Non-Application Layer Protocol        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644241 Sample: Nyx4r.arm5.elf Startdate: 20/03/2025 Architecture: LINUX Score: 64 8 daisy.ubuntu.com 2->8 10 Antivirus / Scanner detection for submitted sample 2->10 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected Okiru 2->14 6 Nyx4r.arm5.elf 2->6         started        signatures3 process4

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        Nyx4r.arm5.elf56%VirustotalBrowse
        Nyx4r.arm5.elf61%ReversingLabsLinux.Trojan.Mirai
        Nyx4r.arm5.elf100%AviraEXP/ELF.Mirai.Bootnet.oc

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Download Network PCAP: filtered – full

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        		162.213.35.24
        		truefalse
          		high

          World Map of Contacted IPs

          ⊘No contacted IP infos

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          daisy.ubuntu.comNyx4r.x86.elfGet hashmaliciousOkiruBrowse
          • 162.213.35.25
          hoho.mips.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          hoho.i486.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25
          arm7.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25
          arm6.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          mpsl.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          x86.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25
          arm.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          rtk.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          zte.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
          Entropy (8bit):6.025681588086173
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:Nyx4r.arm5.elf
          File size:50'652 bytes
          MD5:b30829bfc63b8ba3233ce7e2f245e92e
          SHA1:e6830c8fb0f8d7776332db39359cf712af33fe49
          SHA256:30540730152bea3d2aa46670528ce8f842b33e403cfbc557a21d880a1fb757c0
          SHA512:25e406b7e4ec81022bc98e461510a71f249f395fd0185d990053341343cdcf72e5fd6863cdb2418d174b04909d2d48286848b343b0cd8ff88561b4bb1c723dd6
          SSDEEP:768:u7RNKVYqe/cntRehkCPgwEc4nXhVJlrPQKJAhp9g0od8Qo1Pb27wCVy/rCxHghWf:63OnSyCPg9yKJ2G8Qo1jZaiol5bEF4
          TLSH:5A33F9C27881BA29C3D16777EE5F018E3314A7D8D1DE3353C8281B947A8A95F0DA7B46
          File Content Preview:.ELF...a..........(.........4...........4. ...(.........4...4...4...................................................................,...,...............0...0...0...h...................D...D...D...................Q.td............................/lib/ld-uCl

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:ARM
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:ARM - ABI
          ABI Version:0
          Entry Point Address:0x8ed8
          Flags:0x2
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:6
          Section Header Offset:49932
          Section Header Size:40
          Number of Section Headers:18
          Header String Table Index:17

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .interpPROGBITS0x80f40xf40x140x00x2A001
          .hashHASH0x81080x1080x22c0x40x2A304
          .dynsymDYNSYM0x83340x3340x4600x100x2A414
          .dynstrSTRTAB0x87940x7940x2260x00x2A001
          .rel.pltREL0x89bc0x9bc0x1a00x80x2A374
          .initPROGBITS0x8b5c0xb5c0x180x00x6AX004
          .pltPROGBITS0x8b740xb740x2840x40x6AX004
          .textPROGBITS0x8df80xdf80xaccc0x00x6AX004
          .finiPROGBITS0x13ac40xbac40x140x00x6AX004
          .rodataPROGBITS0x13ad80xbad80x5540x00x2A004
          .ctorsPROGBITS0x1c0300xc0300x80x00x3WA004
          .dtorsPROGBITS0x1c0380xc0380x80x00x3WA004
          .dynamicDYNAMIC0x1c0440xc0440x980x80x3WA404
          .gotPROGBITS0x1c0dc0xc0dc0xdc0x40x3WA004
          .dataPROGBITS0x1c1b80xc1b80xe00x00x3WA004
          .bssNOBITS0x1c2980xc2980x19c0x00x3WA004
          .shstrtabSTRTAB0x00xc2980x730x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          PHDR0x340x80340x80340xc00xc02.21720x5R E0x4
          INTERP0xf40x80f40x80f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
          LOAD0x00x80000x80000xc02c0xc02c6.06060x5R E0x8000.interp .hash .dynsym .dynstr .rel.plt .init .plt .text .fini .rodata
          LOAD0xc0300x1c0300x1c0300x2680x4043.13390x6RW 0x8000.ctors .dtors .dynamic .got .data .bss
          DYNAMIC0xc0440x1c0440x1c0440x980x981.92470x6RW 0x4.dynamic
          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

          Dynamic Tags

          TypeMetaValueTag
          DT_NEEDEDsharedliblibc.so.00x1
          DT_INITvalue0x8b5c0xc
          DT_FINIvalue0x13ac40xd
          DT_HASHvalue0x81080x4
          DT_STRTABvalue0x87940x5
          DT_SYMTABvalue0x83340x6
          DT_STRSZbytes5500xa
          DT_SYMENTbytes160xb
          DT_DEBUGvalue0x00x15
          DT_PLTGOTvalue0x1c0dc0x3
          DT_PLTRELSZbytes4160x2
          DT_PLTRELpltrelDT_REL0x14
          DT_JMPRELvalue0x89bc0x17
          DT_NULLvalue0x00x0

          Symbols

          NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
          .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __aeabi_idiv0.dynsym0x13a844FUNC<unknown>DEFAULT8
          __aeabi_ldiv0.dynsym0x13a844FUNC<unknown>DEFAULT8
          __aeabi_uidiv.dynsym0x137c40FUNC<unknown>DEFAULT8
          __aeabi_uidivmod.dynsym0x138bc24FUNC<unknown>DEFAULT8
          __bss_end__.dynsym0x1c4340NOTYPE<unknown>DEFAULTSHN_ABS
          __bss_start.dynsym0x1c2980NOTYPE<unknown>DEFAULTSHN_ABS
          __bss_start__.dynsym0x1c2980NOTYPE<unknown>DEFAULTSHN_ABS
          __data_start.dynsym0x1c1b80NOTYPE<unknown>DEFAULT17
          __div0.dynsym0x13a844FUNC<unknown>DEFAULT8
          __end__.dynsym0x1c4340NOTYPE<unknown>DEFAULTSHN_ABS
          __errno_location.dynsym0x8d6832FUNC<unknown>DEFAULTSHN_UNDEF
          __modsi3.dynsym0x139a0228FUNC<unknown>DEFAULT8
          __uClibc_main.dynsym0x8d14488FUNC<unknown>DEFAULTSHN_UNDEF
          __udivsi3.dynsym0x137c4248FUNC<unknown>DEFAULT8
          __umodsi3.dynsym0x138d4204FUNC<unknown>DEFAULT8
          _bss_end__.dynsym0x1c4340NOTYPE<unknown>DEFAULTSHN_ABS
          _edata.dynsym0x1c2980NOTYPE<unknown>DEFAULTSHN_ABS
          _end.dynsym0x1c4340NOTYPE<unknown>DEFAULTSHN_ABS
          _start.dynsym0x8ed880FUNC<unknown>DEFAULT8
          abort.dynsym0x8c60352FUNC<unknown>DEFAULTSHN_UNDEF
          atoi.dynsym0x8d8012FUNC<unknown>DEFAULTSHN_UNDEF
          bind.dynsym0x8c9c44FUNC<unknown>DEFAULTSHN_UNDEF
          calloc.dynsym0x8c6c88FUNC<unknown>DEFAULTSHN_UNDEF
          clock.dynsym0x8da452FUNC<unknown>DEFAULTSHN_UNDEF
          close.dynsym0x8dd444FUNC<unknown>DEFAULTSHN_UNDEF
          closedir.dynsym0x8dbc196FUNC<unknown>DEFAULTSHN_UNDEF
          connect.dynsym0x8bb844FUNC<unknown>DEFAULTSHN_UNDEF
          exit.dynsym0x8d74172FUNC<unknown>DEFAULTSHN_UNDEF
          fcntl.dynsym0x8dc8116FUNC<unknown>DEFAULTSHN_UNDEF
          fork.dynsym0x8d0844FUNC<unknown>DEFAULTSHN_UNDEF
          free.dynsym0x8de0288FUNC<unknown>DEFAULTSHN_UNDEF
          getpid.dynsym0x8bdc44FUNC<unknown>DEFAULTSHN_UNDEF
          getppid.dynsym0x8d2c44FUNC<unknown>DEFAULTSHN_UNDEF
          getsockname.dynsym0x8dec44FUNC<unknown>DEFAULTSHN_UNDEF
          getsockopt.dynsym0x8d5c48FUNC<unknown>DEFAULTSHN_UNDEF
          inet_addr.dynsym0x8ca836FUNC<unknown>DEFAULTSHN_UNDEF
          ioctl.dynsym0x8b9480FUNC<unknown>DEFAULTSHN_UNDEF
          kill.dynsym0x8c8444FUNC<unknown>DEFAULTSHN_UNDEF
          listen.dynsym0x8cfc44FUNC<unknown>DEFAULTSHN_UNDEF
          malloc.dynsym0x8c0c400FUNC<unknown>DEFAULTSHN_UNDEF
          memcpy.dynsym0x8bf44FUNC<unknown>DEFAULTSHN_UNDEF
          memmove.dynsym0x8bc44FUNC<unknown>DEFAULTSHN_UNDEF
          memset.dynsym0x8d20156FUNC<unknown>DEFAULTSHN_UNDEF
          open.dynsym0x8d9892FUNC<unknown>DEFAULTSHN_UNDEF
          opendir.dynsym0x8d44264FUNC<unknown>DEFAULTSHN_UNDEF
          prctl.dynsym0x8be848FUNC<unknown>DEFAULTSHN_UNDEF
          printf.dynsym0x8ba076FUNC<unknown>DEFAULTSHN_UNDEF
          read.dynsym0x8ccc44FUNC<unknown>DEFAULTSHN_UNDEF
          readdir.dynsym0x8c48224FUNC<unknown>DEFAULTSHN_UNDEF
          readlink.dynsym0x8c0044FUNC<unknown>DEFAULTSHN_UNDEF
          realloc.dynsym0x8cf0312FUNC<unknown>DEFAULTSHN_UNDEF
          recv.dynsym0x8bac44FUNC<unknown>DEFAULTSHN_UNDEF
          recvfrom.dynsym0x8c2452FUNC<unknown>DEFAULTSHN_UNDEF
          select.dynsym0x8c3c48FUNC<unknown>DEFAULTSHN_UNDEF
          send.dynsym0x8c5444FUNC<unknown>DEFAULTSHN_UNDEF
          sendto.dynsym0x8ce452FUNC<unknown>DEFAULTSHN_UNDEF
          setsid.dynsym0x8db044FUNC<unknown>DEFAULTSHN_UNDEF
          setsockopt.dynsym0x8cb448FUNC<unknown>DEFAULTSHN_UNDEF
          sleep.dynsym0x8c18420FUNC<unknown>DEFAULTSHN_UNDEF
          socket.dynsym0x8c3044FUNC<unknown>DEFAULTSHN_UNDEF
          strcat.dynsym0x8c9040FUNC<unknown>DEFAULTSHN_UNDEF
          strcmp.dynsym0x8d5028FUNC<unknown>DEFAULTSHN_UNDEF
          strcpy.dynsym0x8b8828FUNC<unknown>DEFAULTSHN_UNDEF
          strlen.dynsym0x8d8c96FUNC<unknown>DEFAULTSHN_UNDEF
          strstr.dynsym0x8cc0248FUNC<unknown>DEFAULTSHN_UNDEF
          time.dynsym0x8d3844FUNC<unknown>DEFAULTSHN_UNDEF
          unlink.dynsym0x8cd844FUNC<unknown>DEFAULTSHN_UNDEF
          usleep.dynsym0x8bd076FUNC<unknown>DEFAULTSHN_UNDEF
          write.dynsym0x8c7844FUNC<unknown>DEFAULTSHN_UNDEF

          Network Behavior

          Download Network PCAP: filtered – full

          TimestampSource PortDest PortSource IPDest IP
          Mar 20, 2025 13:35:27.777498960 CET5650653192.168.2.131.1.1.1
          Mar 20, 2025 13:35:27.777551889 CET5473753192.168.2.131.1.1.1
          Mar 20, 2025 13:35:27.876251936 CET53547371.1.1.1192.168.2.13
          Mar 20, 2025 13:35:27.877083063 CET53565061.1.1.1192.168.2.13

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Mar 20, 2025 13:35:27.777498960 CET192.168.2.131.1.1.10x8161Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
          Mar 20, 2025 13:35:27.777551889 CET192.168.2.131.1.1.10x2950Standard query (0)daisy.ubuntu.com28IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Mar 20, 2025 13:35:27.877083063 CET1.1.1.1192.168.2.130x8161No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
          Mar 20, 2025 13:35:27.877083063 CET1.1.1.1192.168.2.130x8161No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

          System Behavior

          General

          Start time (UTC):12:32:42
          Start date (UTC):20/03/2025
          Path:/tmp/Nyx4r.arm5.elf
          Arguments:/tmp/Nyx4r.arm5.elf
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          File Activities

          Process Activities

          System Activities