Create Interactive Tour
Linux
Analysis Report
xd.powerpc-440fp.elf
Overview
General Information
| Sample name: | xd.powerpc-440fp.elf |
| Analysis ID: | 1655022 |
| MD5: | c0eaa454ae080b7c1690454a672f92a4 |
| SHA1: | 0600b71dd75ff1f350d1c65ef9eb381eb14bb1e7 |
| SHA256: | fcdacc5f7797c1ed7400c664a1354e6639c4360d4d46c7fe6113d5517f5fb5eb |
| Tags: | elfuser-abuse_ch |
| Infos: |  |
Detection
Mirai
| Score: | 88 |
| Range: | 0 - 100 |
Signatures
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Yara detected Mirai
Sample deletes itself
Sample is packed with UPX
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Deletes log files
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Reads CPU information from /sys indicative of miner or evasive malware
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match
Classification
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1655022 |
| Start date and time: | 2025-04-02 21:47:28 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 38s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultlinuxfilecookbook.jbs |
| Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
| Analysis Mode: | default |
| Sample name: | xd.powerpc-440fp.elf |
| Detection: | MAL |
| Classification: | mal88.spre.troj.evad.linELF@0/16@0/0 |
- Connection to analysis system has been lost, crash info: Unknown
- system is lnxubuntu20
- xd.powerpc-440fp.elf New Fork (PID: 5438, Parent: 5436)
- xd.powerpc-440fp.elf New Fork (PID: 5439, Parent: 5436)
- xd.powerpc-440fp.elf New Fork (PID: 5441, Parent: 5436)
- xd.powerpc-440fp.elf New Fork (PID: 5444, Parent: 5441)
- xd.powerpc-440fp.elf New Fork (PID: 5450, Parent: 5441)
- xd.powerpc-440fp.elf New Fork (PID: 5451, Parent: 5441)
- systemd New Fork (PID: 5465, Parent: 1)
- systemd New Fork (PID: 5484, Parent: 1)
- systemd New Fork (PID: 5485, Parent: 1)
- systemd New Fork (PID: 5486, Parent: 1)
- systemd New Fork (PID: 5487, Parent: 1)
- systemd New Fork (PID: 5490, Parent: 1)
- systemd New Fork (PID: 5516, Parent: 1)
- systemd New Fork (PID: 5548, Parent: 1)
- systemd New Fork (PID: 5549, Parent: 1)
- systemd New Fork (PID: 5550, Parent: 1)
- systemd New Fork (PID: 5551, Parent: 1)
- systemd New Fork (PID: 5552, Parent: 1)
- systemd New Fork (PID: 5553, Parent: 2935)
- gdm3 New Fork (PID: 5554, Parent: 1400)
- gdm3 New Fork (PID: 5555, Parent: 1400)
- gdm3 New Fork (PID: 5556, Parent: 1400)
- systemd New Fork (PID: 5557, Parent: 1)
- systemd New Fork (PID: 5559, Parent: 1)
- systemd New Fork (PID: 5561, Parent: 1)
- systemd New Fork (PID: 5562, Parent: 1)
- systemd New Fork (PID: 5563, Parent: 1)
- gpu-manager New Fork (PID: 5564, Parent: 5563)
- sh New Fork (PID: 5565, Parent: 5564)
- gpu-manager New Fork (PID: 5566, Parent: 5563)
- sh New Fork (PID: 5567, Parent: 5566)
- gpu-manager New Fork (PID: 5568, Parent: 5563)
- sh New Fork (PID: 5569, Parent: 5568)
- gpu-manager New Fork (PID: 5570, Parent: 5563)
- sh New Fork (PID: 5571, Parent: 5570)
- gpu-manager New Fork (PID: 5572, Parent: 5563)
- sh New Fork (PID: 5573, Parent: 5572)
- gpu-manager New Fork (PID: 5574, Parent: 5563)
- sh New Fork (PID: 5575, Parent: 5574)
- gpu-manager New Fork (PID: 5576, Parent: 5563)
- sh New Fork (PID: 5577, Parent: 5576)
- gpu-manager New Fork (PID: 5578, Parent: 5563)
- sh New Fork (PID: 5579, Parent: 5578)
- systemd (deleted) New Fork (PID: 5580, Parent: 1)
- generate-config New Fork (PID: 5581, Parent: 5580)
- gvfsd-fuse New Fork (PID: 5582, Parent: 3122)
- systemd (deleted) New Fork (PID: 5583, Parent: 1)
- systemd (deleted) New Fork (PID: 5587, Parent: 1)
- systemd (deleted) New Fork (PID: 5591, Parent: 1)
- systemd (deleted) New Fork (PID: 5599, Parent: 1)
- systemd (deleted) New Fork (PID: 5602, Parent: 1)
- systemd (deleted) New Fork (PID: 5604, Parent: 1)
- systemd (deleted) New Fork (PID: 5607, Parent: 1)
- systemd (deleted) New Fork (PID: 5608, Parent: 1)
- gpu-manager New Fork (PID: 5609, Parent: 5608)
- gpu-manager New Fork (PID: 5610, Parent: 5608)
- gpu-manager New Fork (PID: 5611, Parent: 5608)
- gpu-manager New Fork (PID: 5612, Parent: 5608)
- gpu-manager New Fork (PID: 5613, Parent: 5608)
- gpu-manager New Fork (PID: 5614, Parent: 5608)
- gpu-manager New Fork (PID: 5615, Parent: 5608)
- gpu-manager New Fork (PID: 5616, Parent: 5608)
- systemd (deleted) New Fork (PID: 5617, Parent: 1)
- systemd (deleted) New Fork (PID: 5618, Parent: 1)
- gpu-manager New Fork (PID: 5619, Parent: 5618)
- gpu-manager New Fork (PID: 5620, Parent: 5618)
- gpu-manager New Fork (PID: 5621, Parent: 5618)
- gpu-manager New Fork (PID: 5622, Parent: 5618)
- gpu-manager New Fork (PID: 5623, Parent: 5618)
- gpu-manager New Fork (PID: 5624, Parent: 5618)
- gpu-manager New Fork (PID: 5625, Parent: 5618)
- gpu-manager New Fork (PID: 5626, Parent: 5618)
- systemd (deleted) New Fork (PID: 5627, Parent: 1)
- systemd (deleted) New Fork (PID: 5628, Parent: 1)
- gpu-manager New Fork (PID: 5629, Parent: 5628)
- gpu-manager New Fork (PID: 5630, Parent: 5628)
- gpu-manager New Fork (PID: 5631, Parent: 5628)
- gpu-manager New Fork (PID: 5632, Parent: 5628)
- gpu-manager New Fork (PID: 5633, Parent: 5628)
- gpu-manager New Fork (PID: 5634, Parent: 5628)
- gpu-manager New Fork (PID: 5635, Parent: 5628)
- gpu-manager New Fork (PID: 5636, Parent: 5628)
- systemd (deleted) New Fork (PID: 5637, Parent: 1)
- systemd (deleted) New Fork (PID: 5638, Parent: 1)
- gpu-manager New Fork (PID: 5639, Parent: 5638)
- gpu-manager New Fork (PID: 5640, Parent: 5638)
- gpu-manager New Fork (PID: 5641, Parent: 5638)
- gpu-manager New Fork (PID: 5642, Parent: 5638)
- gpu-manager New Fork (PID: 5643, Parent: 5638)
- gpu-manager New Fork (PID: 5644, Parent: 5638)
- gpu-manager New Fork (PID: 5645, Parent: 5638)
- gpu-manager New Fork (PID: 5646, Parent: 5638)
- systemd (deleted) New Fork (PID: 5647, Parent: 1)
- systemd (deleted) New Fork (PID: 5648, Parent: 1)
- gpu-manager New Fork (PID: 5649, Parent: 5648)
- gpu-manager New Fork (PID: 5650, Parent: 5648)
- gpu-manager New Fork (PID: 5651, Parent: 5648)
- gpu-manager New Fork (PID: 5652, Parent: 5648)
- gpu-manager New Fork (PID: 5653, Parent: 5648)
- gpu-manager New Fork (PID: 5654, Parent: 5648)
- gpu-manager New Fork (PID: 5655, Parent: 5648)
- gpu-manager New Fork (PID: 5656, Parent: 5648)
- systemd (deleted) New Fork (PID: 5657, Parent: 1)
- systemd (deleted) New Fork (PID: 5658, Parent: 1)
- systemd (deleted) New Fork (PID: 5660, Parent: 2935)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Mirai | Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. | No Attribution |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
| Linux_Trojan_Gafgyt_ea92cca8 | unknown | unknown |
| |
| Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
| Linux_Trojan_Gafgyt_ea92cca8 | unknown | unknown |
| |
| Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
| Click to see the 17 entries | ||||
⊘No Suricata rule has matched
- • AV Detection
- • Bitcoin Miner
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Stealing of Sensitive Information
- • Remote Access Functionality
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | TCP traffic: | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | Program segment: | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
Data Obfuscation | |
|---|
| Source: | String containing UPX found: | ||
| Source: | String containing UPX found: | ||
| Source: | String containing UPX found: | ||
Persistence and Installation Behavior | |
|---|
| Source: | File: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Pkill executable: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | Log file created: | |||
| Source: | Log file created: | |||
| Source: | Log file created: | |||
| Source: | Log file created: | |||
| Source: | Log file created: | |||
| Source: | Log file created: | Jump to dropped file | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | Submission file: | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | Windows Management Instrumentation | 1 Scripting | Path Interception | 1 File and Directory Permissions Modification | 1 OS Credential Dumping | 11 Security Software Discovery | Remote Services | Data from Local System | 1 Non-Standard Port | Exfiltration Over Other Network Medium | 1 Service Stop |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Disable or Modify Tools | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Indicator Removal | Security Account Manager | 1 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Obfuscated Files or Information | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 File Deletion | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
⊘No configs have been found
Is Dropped
Number of created Files
Is malicious
Internet| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | EXP/ELF.Agent.F.118 |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 24.152.38.191 | unknown | unknown | 270564 | MasterDaWebBR | false | |
| 8.51.252.70 | unknown | United States | 3356 | LEVEL3US | false | |
| 63.194.248.97 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 197.227.214.230 | unknown | Mauritius | 23889 | MauritiusTelecomMU | false | |
| 206.151.101.48 | unknown | United States | 3561 | CENTURYLINK-LEGACY-SAVVISUS | false | |
| 57.53.25.25 | unknown | Belgium | 2686 | ATGS-MMD-ASUS | false | |
| 1.250.39.35 | unknown | Korea Republic of | 9318 | SKB-ASSKBroadbandCoLtdKR | false | |
| 172.95.72.121 | unknown | United States | 5650 | FRONTIER-FRTRUS | false | |
| 84.56.198.146 | unknown | Germany | 3209 | VODANETInternationalIP-BackboneofVodafoneDE | false | |
| 108.221.193.176 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 70.58.184.36 | unknown | United States | 209 | CENTURYLINK-US-LEGACY-QWESTUS | false | |
| 208.78.80.242 | unknown | United States | 32654 | TWRS-CHIUS | false | |
| 164.167.168.182 | unknown | United States | 5972 | DNIC-ASBLK-05800-06055US | false | |
| 73.233.19.172 | unknown | United States | 7922 | COMCAST-7922US | false | |
| 206.64.115.33 | unknown | United States | 701 | UUNETUS | false | |
| 189.60.15.209 | unknown | Brazil | 28573 | CLAROSABR | false | |
| 122.165.18.141 | unknown | India | 24560 | AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices | false | |
| 92.66.63.74 | unknown | Netherlands | 1136 | KPNKPNNationalEU | false | |
| 14.179.184.201 | unknown | Viet Nam | 45899 | VNPT-AS-VNVNPTCorpVN | false | |
| 253.65.66.119 | unknown | Reserved | unknown | unknown | false | |
| 45.120.3.0 | unknown | Hong Kong | 9381 | HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK | false | |
| 141.24.40.53 | unknown | Germany | 680 | DFNVereinzurFoerderungeinesDeutschenForschungsnetzese | false | |
| 60.152.153.178 | unknown | Japan | 17676 | GIGAINFRASoftbankBBCorpJP | false | |
| 35.143.47.40 | unknown | United States | 33363 | BHN-33363US | false | |
| 96.216.201.246 | unknown | United States | 7922 | COMCAST-7922US | false | |
| 91.221.63.214 | unknown | Latvia | 51763 | INTECHSYSTEMS-ASLV | false | |
| 31.231.3.132 | unknown | Germany | 3320 | DTAGInternetserviceprovideroperationsDE | false | |
| 175.156.155.113 | unknown | Singapore | 4773 | MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr | false | |
| 249.221.214.226 | unknown | Reserved | unknown | unknown | false | |
| 192.219.160.1 | unknown | Canada | 394352 | FASTNET-COMMUNICATIONSCA | false | |
| 111.181.255.58 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false | |
| 2.35.223.218 | unknown | Italy | 30722 | VODAFONE-IT-ASNIT | false | |
| 247.55.126.141 | unknown | Reserved | unknown | unknown | false | |
| 133.222.200.221 | unknown | Japan | 2907 | SINET-ASResearchOrganizationofInformationandSystemsN | false | |
| 201.141.90.238 | unknown | Mexico | 28548 | CablevisionSAdeCVMX | false | |
| 245.51.251.71 | unknown | Reserved | unknown | unknown | false | |
| 35.30.158.150 | unknown | United States | 36375 | UMICH-AS-5US | false | |
| 148.199.79.253 | unknown | United States | 31382 | KAPSCH-ASAT | false | |
| 104.174.66.47 | unknown | United States | 20001 | TWC-20001-PACWESTUS | false | |
| 86.150.128.241 | unknown | United Kingdom | 2856 | BT-UK-ASBTnetUKRegionalnetworkGB | false | |
| 92.64.98.217 | unknown | Netherlands | 1136 | KPNKPNNationalEU | false | |
| 121.110.71.88 | unknown | Japan | 2516 | KDDIKDDICORPORATIONJP | false | |
| 103.52.115.182 | unknown | unknown | 135852 | GLXNET-ASGalaxynetConnectionsPrivateLimitedIN | false | |
| 255.29.173.90 | unknown | Reserved | unknown | unknown | false | |
| 59.173.136.152 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false | |
| 200.125.55.72 | unknown | Uruguay | 6057 | AdministracionNacionaldeTelecomunicacionesUY | false | |
| 84.249.37.168 | unknown | Finland | 1759 | TSF-IP-CORETeliaFinlandOyjEU | false | |
| 216.149.33.166 | unknown | United States | 2828 | XO-AS15US | false | |
| 102.168.205.136 | unknown | Tunisia | 37693 | TUNISIANATN | false | |
| 64.30.36.79 | unknown | United States | 3356 | LEVEL3US | false | |
| 185.35.151.125 | unknown | United Kingdom | 13213 | UK2NET-ASGB | false | |
| 54.114.231.98 | unknown | United States | 16509 | AMAZON-02US | false | |
| 44.153.151.136 | unknown | United States | 62383 | LDS-ASBE | false | |
| 98.75.219.105 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 183.75.245.103 | unknown | Japan | 9605 | DOCOMONTTDOCOMOINCJP | false | |
| 77.186.103.75 | unknown | Germany | 6805 | TDDE-ASN1DE | false | |
| 119.20.121.118 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false | |
| 53.79.97.196 | unknown | Germany | 31399 | DAIMLER-ASITIGNGlobalNetworkDE | false | |
| 223.95.144.140 | unknown | China | 56041 | CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC | false | |
| 162.52.129.115 | unknown | United States | 35893 | ACPCA | false | |
| 108.114.132.195 | unknown | United States | 10507 | SPCSUS | false | |
| 150.146.54.14 | unknown | Italy | 137 | ASGARRConsortiumGARREU | false | |
| 99.185.4.139 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 186.218.251.252 | unknown | Brazil | 28573 | CLAROSABR | false | |
| 206.204.146.3 | unknown | United States | 4544 | CONXION-AUS | false | |
| 142.48.49.185 | unknown | Canada | 3633 | PROVINCE-OF-BRITISH-COLUMBIACA | false | |
| 213.209.129.92 | unknown | Germany | 42821 | RAPIDNET-DEHaunstetterStr19DE | false | |
| 167.94.219.212 | unknown | United States | 20278 | NEXEONUS | false | |
| 58.185.92.31 | unknown | Singapore | 3758 | SINGNETSingNetSG | false | |
| 219.38.72.177 | unknown | Japan | 17676 | GIGAINFRASoftbankBBCorpJP | false | |
| 126.207.170.103 | unknown | Japan | 17676 | GIGAINFRASoftbankBBCorpJP | false | |
| 32.120.166.85 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 133.120.168.236 | unknown | Japan | 2522 | PPP-EXPJapanNetworkInformationCenterJP | false | |
| 83.11.154.236 | unknown | Poland | 5617 | TPNETPL | false | |
| 191.95.135.123 | unknown | Colombia | 27805 | EPMTelecomunicacionesSAESPCO | false | |
| 141.58.177.69 | unknown | Germany | 553 | BELWUEBelWue-KoordinationEU | false | |
| 162.54.206.16 | unknown | United States | 35893 | ACPCA | false | |
| 17.133.93.61 | unknown | United States | 714 | APPLE-ENGINEERINGUS | false | |
| 188.112.36.200 | unknown | Poland | 42739 | FONE-ASNPL | false | |
| 218.204.71.7 | unknown | China | 9808 | CMNET-GDGuangdongMobileCommunicationCoLtdCN | false | |
| 162.196.177.236 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 72.28.216.77 | unknown | United States | 11776 | ATLANTICBB-JOHNSTOWNUS | false | |
| 95.225.237.39 | unknown | Italy | 3269 | ASN-IBSNAZIT | false | |
| 53.153.189.24 | unknown | Germany | 31399 | DAIMLER-ASITIGNGlobalNetworkDE | false | |
| 64.9.22.52 | unknown | United States | 3356 | LEVEL3US | false | |
| 115.3.126.22 | unknown | Korea Republic of | 4766 | KIXS-AS-KRKoreaTelecomKR | false | |
| 173.202.84.5 | unknown | United States | 209 | CENTURYLINK-US-LEGACY-QWESTUS | false | |
| 201.212.72.78 | unknown | Argentina | 10481 | TelecomArgentinaSAAR | false | |
| 211.207.222.183 | unknown | Korea Republic of | 9318 | SKB-ASSKBroadbandCoLtdKR | false | |
| 199.108.151.31 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 36.22.80.62 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false | |
| 45.16.142.91 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 245.136.211.105 | unknown | Reserved | unknown | unknown | false | |
| 161.192.86.107 | unknown | United States | 263740 | CorporacionLaceibanetsocietyHN | false | |
| 165.197.249.181 | unknown | United States | 2152 | CSUNET-NWUS | false | |
| 27.133.180.48 | unknown | Japan | 10013 | FBDCFreeBitCoLtdJP | false | |
| 202.188.60.200 | unknown | Malaysia | 4788 | TMNET-AS-APTMNetInternetServiceProviderMY | false | |
| 61.108.123.1 | unknown | Korea Republic of | 9316 | DACOM-PUBNETPLUS-AS-KRDACOM-PUBNETPLUSKR | false | |
| 162.26.170.131 | unknown | Switzerland | 385 | AFCONC-BLOCK1-ASUS | false | |
| 181.231.171.59 | unknown | Argentina | 10481 | TelecomArgentinaSAAR | false |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ATT-INTERNET4US | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| MasterDaWebBR | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Njrat | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AsyncRAT, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | AsyncRAT, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | Njrat | Browse |
| ||
| Get hash | malicious | Njrat | Browse |
| ||
| Get hash | malicious | Clipboard Hijacker, Quasar | Browse |
| ||
| LEVEL3US | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| MauritiusTelecomMU | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Gafgyt, Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
|
⊘No context
⊘No context
| Process: | /usr/bin/pulseaudio |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10 |
| Entropy (8bit): | 2.9219280948873623 |
| Encrypted: | false |
| SSDEEP: | 3:5bkPn:pkP |
| MD5: | FF001A15CE15CF062A3704CEA2991B5F |
| SHA1: | B06F6855F376C3245B82212AC73ADED55DFE5DEF |
| SHA-256: | C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A |
| SHA-512: | 65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | /usr/bin/pulseaudio |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 18 |
| Entropy (8bit): | 3.4613201402110088 |
| Encrypted: | false |
| SSDEEP: | 3:5bkrIZsXvn:pkckv |
| MD5: | 28FE6435F34B3367707BB1C5D5F6B430 |
| SHA1: | EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6 |
| SHA-256: | 721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0 |
| SHA-512: | 6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | /usr/sbin/gdm3 |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5 |
| Entropy (8bit): | 1.9219280948873623 |
| Encrypted: | false |
| SSDEEP: | 3:Fdcn:nc |
| MD5: | ED6EB13AEC2CD903943D6E440CD63013 |
| SHA1: | 623E520BFFFB648592A6103DD34A53C5233CA72E |
| SHA-256: | DF991FFF6B92569DB010ADECAC183EAA7BFA112B46A61A259C40FEC0597C3DF3 |
| SHA-512: | D6E04CD12034B1BCB87149D2018B177D9AA345FE777209F77B75C5BE2E7334A1FAF3BC61116801B9D67A64E2DB2154D1C46D499FBB438E5CF35DC799E1D08C85 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | /usr/bin/pulseaudio |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5 |
| Entropy (8bit): | 1.3709505944546687 |
| Encrypted: | false |
| SSDEEP: | 3:FQo:d |
| MD5: | 9777879D6C08CAA3943D510585D2F1E4 |
| SHA1: | 6B73FC01915759DD03A690F77D2625B0A0CFD5DC |
| SHA-256: | 872542909E99BEFE54104CE0BE375646285DA1658C7E70470429C0F4E1CD9517 |
| SHA-512: | 529D13A674FDC288335BC59500E5C2435AE37CA05B28B61418A6AC443B9EFB23F01476A499952C09A5A228588AC4BC27430C7FF07DB08FD24CA75E17B21133AB |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | /usr/bin/gpu-manager |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 25 |
| Entropy (8bit): | 2.7550849518197795 |
| Encrypted: | false |
| SSDEEP: | 3:JoT/V9fDVbn:M/V3n |
| MD5: | 078760523943E160756979906B85FB5E |
| SHA1: | 0962643266F4C5537F7D125046F28F21D6DD0C89 |
| SHA-256: | 048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C |
| SHA-512: | DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | /usr/bin/gpu-manager |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1371 |
| Entropy (8bit): | 4.8296848499188485 |
| Encrypted: | false |
| SSDEEP: | 24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O |
| MD5: | 3AF77E630DA00B3BE24F4E8AA5D78B13 |
| SHA1: | BCF2D99E002F6DE2413A183227B011CFBEF5673D |
| SHA-256: | EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA |
| SHA-512: | 8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.933001562057124 |
| TrID: |
|
| File name: | xd.powerpc-440fp.elf |
| File size: | 28'344 bytes |
| MD5: | c0eaa454ae080b7c1690454a672f92a4 |
| SHA1: | 0600b71dd75ff1f350d1c65ef9eb381eb14bb1e7 |
| SHA256: | fcdacc5f7797c1ed7400c664a1354e6639c4360d4d46c7fe6113d5517f5fb5eb |
| SHA512: | e4334a381b7093bb9deba02f8540ef42299ef31426e4e4b604b1c9ad78a078be8706ec8a347d004aeaf0a52a1baf3b0398781d1b07b70cec4dd4e53cb6dc1024 |
| SSDEEP: | 384:6U/AqTww77KcMxahkbgShjraGJcezN8Kvnf4kizS74fbLzLkYAM4uVcqgw05ixJ8:lAYMNxPblPd2eHX4k8L//4uVcqgw0+aZ |
| TLSH: | 38D2E069CAB2DC98E3A6EDE90FB1C2153FD1181DF23086E128F07E46A927557290CCD8 |
| File Content Preview: | .ELF......................[....4.........4. ...(......................m...m.........................................dt.Q.............................?..UPX!...........X...X.......Q.......?.E.h4...@b.............[GnE..M.........#...skS..........F.......DKP |
ELF header | |
|---|---|
| Class: | |
| Data: | |
| Version: | |
| Machine: | |
| Version Number: | |
| Type: | |
| OS/ABI: | |
| ABI Version: | 0 |
| Entry Point Address: | |
| Flags: | |
| ELF Header Size: | 52 |
| Program Header Offset: | 52 |
| Program Header Size: | 32 |
| Number of Program Headers: | 3 |
| Section Header Offset: | 0 |
| Section Header Size: | 40 |
| Number of Section Headers: | 0 |
| Header String Table Index: | 0 |
| Type | Offset | Virtual Address | Physical Address | File Size | Memory Size | Entropy | Flags | Flags Description | Align | Prog Interpreter | Section Mappings |
|---|---|---|---|---|---|---|---|---|---|---|---|
| LOAD | 0x0 | 0x100000 | 0x100000 | 0x6db8 | 0x6db8 | 7.9363 | 0x5 | R E | 0x10000 | ||
| LOAD | 0x704 | 0x10010704 | 0x10010704 | 0x0 | 0x0 | 0.0000 | 0x6 | RW | 0x10000 | ||
| GNU_STACK | 0x0 | 0x0 | 0x0 | 0x0 | 0x0 | 0.0000 | 0x6 | RW | 0x4 |
Download Network PCAP: filtered – full
- Total Packets: 159
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Apr 2, 2025 21:48:19.597142935 CEST | 52646 | 7887 | 192.168.2.13 | 213.209.129.92 |
| Apr 2, 2025 21:48:19.631632090 CEST | 52492 | 23 | 192.168.2.13 | 173.74.117.22 |
| Apr 2, 2025 21:48:19.631685972 CEST | 52492 | 23 | 192.168.2.13 | 115.3.126.22 |
| Apr 2, 2025 21:48:19.631700039 CEST | 52492 | 23 | 192.168.2.13 | 211.207.222.183 |
| Apr 2, 2025 21:48:19.631716967 CEST | 52492 | 23 | 192.168.2.13 | 179.198.232.20 |
| Apr 2, 2025 21:48:19.631724119 CEST | 52492 | 23 | 192.168.2.13 | 200.125.55.72 |
| Apr 2, 2025 21:48:19.631758928 CEST | 52492 | 23 | 192.168.2.13 | 219.38.72.177 |
| Apr 2, 2025 21:48:19.631794930 CEST | 52492 | 23 | 192.168.2.13 | 197.99.82.255 |
| Apr 2, 2025 21:48:19.631822109 CEST | 52492 | 23 | 192.168.2.13 | 189.60.15.209 |
| Apr 2, 2025 21:48:19.632229090 CEST | 52492 | 23 | 192.168.2.13 | 126.207.170.103 |
| Apr 2, 2025 21:48:19.632230043 CEST | 52492 | 23 | 192.168.2.13 | 119.20.121.118 |
| Apr 2, 2025 21:48:19.632230043 CEST | 52492 | 23 | 192.168.2.13 | 75.233.53.124 |
| Apr 2, 2025 21:48:19.632231951 CEST | 52492 | 23 | 192.168.2.13 | 65.227.90.229 |
| Apr 2, 2025 21:48:19.632231951 CEST | 52492 | 23 | 192.168.2.13 | 73.233.19.172 |
| Apr 2, 2025 21:48:19.632232904 CEST | 52492 | 23 | 192.168.2.13 | 218.204.71.7 |
| Apr 2, 2025 21:48:19.632236958 CEST | 52492 | 23 | 192.168.2.13 | 97.9.85.127 |
| Apr 2, 2025 21:48:19.632237911 CEST | 52492 | 23 | 192.168.2.13 | 63.194.248.97 |
| Apr 2, 2025 21:48:19.632287025 CEST | 52492 | 23 | 192.168.2.13 | 85.160.150.1 |
| Apr 2, 2025 21:48:19.632298946 CEST | 52492 | 23 | 192.168.2.13 | 135.211.19.57 |
| Apr 2, 2025 21:48:19.632298946 CEST | 52492 | 23 | 192.168.2.13 | 78.1.59.55 |
| Apr 2, 2025 21:48:19.632298946 CEST | 52492 | 23 | 192.168.2.13 | 188.251.149.99 |
| Apr 2, 2025 21:48:19.632298946 CEST | 52492 | 23 | 192.168.2.13 | 70.58.184.36 |
| Apr 2, 2025 21:48:19.632312059 CEST | 52492 | 23 | 192.168.2.13 | 60.152.153.178 |
| Apr 2, 2025 21:48:19.632313967 CEST | 52492 | 23 | 192.168.2.13 | 154.62.123.205 |
| Apr 2, 2025 21:48:19.632313967 CEST | 52492 | 23 | 192.168.2.13 | 147.153.242.104 |
| Apr 2, 2025 21:48:19.632313967 CEST | 52492 | 23 | 192.168.2.13 | 96.216.201.246 |
| Apr 2, 2025 21:48:19.632314920 CEST | 52492 | 23 | 192.168.2.13 | 211.234.43.180 |
| Apr 2, 2025 21:48:19.632313967 CEST | 52492 | 23 | 192.168.2.13 | 1.250.39.35 |
| Apr 2, 2025 21:48:19.632317066 CEST | 52492 | 23 | 192.168.2.13 | 83.11.154.236 |
| Apr 2, 2025 21:48:19.632317066 CEST | 52492 | 23 | 192.168.2.13 | 12.225.203.47 |
| Apr 2, 2025 21:48:19.632317066 CEST | 52492 | 23 | 192.168.2.13 | 161.192.86.107 |
| Apr 2, 2025 21:48:19.632317066 CEST | 52492 | 23 | 192.168.2.13 | 162.196.177.236 |
| Apr 2, 2025 21:48:19.632320881 CEST | 52492 | 23 | 192.168.2.13 | 86.150.128.241 |
| Apr 2, 2025 21:48:19.632320881 CEST | 52492 | 23 | 192.168.2.13 | 165.197.249.181 |
| Apr 2, 2025 21:48:19.632320881 CEST | 52492 | 23 | 192.168.2.13 | 167.94.219.212 |
| Apr 2, 2025 21:48:19.632328987 CEST | 52492 | 23 | 192.168.2.13 | 45.120.3.0 |
| Apr 2, 2025 21:48:19.632328987 CEST | 52492 | 23 | 192.168.2.13 | 72.28.216.77 |
| Apr 2, 2025 21:48:19.632328987 CEST | 52492 | 23 | 192.168.2.13 | 57.53.25.25 |
| Apr 2, 2025 21:48:19.632333040 CEST | 52492 | 23 | 192.168.2.13 | 111.181.255.58 |
| Apr 2, 2025 21:48:19.632339001 CEST | 52492 | 23 | 192.168.2.13 | 173.202.84.5 |
| Apr 2, 2025 21:48:19.632339001 CEST | 52492 | 23 | 192.168.2.13 | 94.241.141.224 |
| Apr 2, 2025 21:48:19.632339001 CEST | 52492 | 23 | 192.168.2.13 | 19.243.154.105 |
| Apr 2, 2025 21:48:19.632364035 CEST | 52492 | 23 | 192.168.2.13 | 24.152.38.191 |
| Apr 2, 2025 21:48:19.632364035 CEST | 52492 | 23 | 192.168.2.13 | 150.102.140.220 |
| Apr 2, 2025 21:48:19.632383108 CEST | 52492 | 23 | 192.168.2.13 | 249.221.214.226 |
| Apr 2, 2025 21:48:19.632430077 CEST | 52492 | 23 | 192.168.2.13 | 206.151.101.48 |
| Apr 2, 2025 21:48:19.632520914 CEST | 52492 | 23 | 192.168.2.13 | 223.95.144.140 |
| Apr 2, 2025 21:48:19.632529974 CEST | 52492 | 23 | 192.168.2.13 | 1.224.75.116 |
| Apr 2, 2025 21:48:19.632544041 CEST | 52492 | 23 | 192.168.2.13 | 102.168.205.136 |
| Apr 2, 2025 21:48:19.632603884 CEST | 52492 | 23 | 192.168.2.13 | 209.45.226.25 |
| Apr 2, 2025 21:48:19.632616043 CEST | 52492 | 23 | 192.168.2.13 | 201.212.72.78 |
| Apr 2, 2025 21:48:19.632630110 CEST | 52492 | 23 | 192.168.2.13 | 247.55.126.141 |
| Apr 2, 2025 21:48:19.632668018 CEST | 52492 | 23 | 192.168.2.13 | 27.133.180.48 |
| Apr 2, 2025 21:48:19.632711887 CEST | 52492 | 23 | 192.168.2.13 | 164.167.168.182 |
| Apr 2, 2025 21:48:19.632745028 CEST | 52492 | 23 | 192.168.2.13 | 162.54.206.16 |
| Apr 2, 2025 21:48:19.632767916 CEST | 52492 | 23 | 192.168.2.13 | 245.51.251.71 |
| Apr 2, 2025 21:48:19.632787943 CEST | 52492 | 23 | 192.168.2.13 | 174.131.225.7 |
| Apr 2, 2025 21:48:19.632822037 CEST | 52492 | 23 | 192.168.2.13 | 53.79.97.196 |
| Apr 2, 2025 21:48:19.632857084 CEST | 52492 | 23 | 192.168.2.13 | 253.65.66.119 |
| Apr 2, 2025 21:48:19.632880926 CEST | 52492 | 23 | 192.168.2.13 | 36.22.80.62 |
| Apr 2, 2025 21:48:19.632906914 CEST | 52492 | 23 | 192.168.2.13 | 122.165.18.141 |
| Apr 2, 2025 21:48:19.632925034 CEST | 52492 | 23 | 192.168.2.13 | 182.148.179.244 |
| Apr 2, 2025 21:48:19.632961035 CEST | 52492 | 23 | 192.168.2.13 | 216.16.115.214 |
| Apr 2, 2025 21:48:19.633048058 CEST | 52492 | 23 | 192.168.2.13 | 35.30.158.150 |
| Apr 2, 2025 21:48:19.633089066 CEST | 52492 | 23 | 192.168.2.13 | 31.231.3.132 |
| Apr 2, 2025 21:48:19.633111000 CEST | 52492 | 23 | 192.168.2.13 | 252.177.142.29 |
| Apr 2, 2025 21:48:19.633169889 CEST | 52492 | 23 | 192.168.2.13 | 222.208.86.167 |
| Apr 2, 2025 21:48:19.633196115 CEST | 52492 | 23 | 192.168.2.13 | 17.133.93.61 |
| Apr 2, 2025 21:48:19.633208990 CEST | 52492 | 23 | 192.168.2.13 | 58.185.92.31 |
| Apr 2, 2025 21:48:19.633240938 CEST | 52492 | 23 | 192.168.2.13 | 103.52.115.182 |
| Apr 2, 2025 21:48:19.633260965 CEST | 52492 | 23 | 192.168.2.13 | 84.249.37.168 |
| Apr 2, 2025 21:48:19.633332014 CEST | 52492 | 23 | 192.168.2.13 | 87.165.212.90 |
| Apr 2, 2025 21:48:19.633341074 CEST | 52492 | 23 | 192.168.2.13 | 45.92.142.223 |
| Apr 2, 2025 21:48:19.633373022 CEST | 52492 | 23 | 192.168.2.13 | 150.146.54.14 |
| Apr 2, 2025 21:48:19.633440971 CEST | 52492 | 23 | 192.168.2.13 | 66.42.116.204 |
| Apr 2, 2025 21:48:19.633457899 CEST | 52492 | 23 | 192.168.2.13 | 243.84.110.60 |
| Apr 2, 2025 21:48:19.633471966 CEST | 52492 | 23 | 192.168.2.13 | 162.26.170.131 |
| Apr 2, 2025 21:48:19.633505106 CEST | 52492 | 23 | 192.168.2.13 | 148.199.79.253 |
| Apr 2, 2025 21:48:19.633522034 CEST | 52492 | 23 | 192.168.2.13 | 202.188.60.200 |
| Apr 2, 2025 21:48:19.633573055 CEST | 52492 | 23 | 192.168.2.13 | 203.51.253.14 |
| Apr 2, 2025 21:48:19.633613110 CEST | 52492 | 23 | 192.168.2.13 | 156.114.148.13 |
| Apr 2, 2025 21:48:19.633621931 CEST | 52492 | 23 | 192.168.2.13 | 191.19.101.153 |
| Apr 2, 2025 21:48:19.633636951 CEST | 52492 | 23 | 192.168.2.13 | 141.24.40.53 |
| Apr 2, 2025 21:48:19.633697033 CEST | 52492 | 23 | 192.168.2.13 | 208.78.80.242 |
| Apr 2, 2025 21:48:19.633713007 CEST | 52492 | 23 | 192.168.2.13 | 35.143.47.40 |
| Apr 2, 2025 21:48:19.633758068 CEST | 52492 | 23 | 192.168.2.13 | 136.154.222.60 |
| Apr 2, 2025 21:48:19.633774042 CEST | 52492 | 23 | 192.168.2.13 | 240.243.172.175 |
| Apr 2, 2025 21:48:19.633786917 CEST | 52492 | 23 | 192.168.2.13 | 121.103.221.237 |
| Apr 2, 2025 21:48:19.633807898 CEST | 52492 | 23 | 192.168.2.13 | 180.82.241.121 |
| Apr 2, 2025 21:48:19.633830070 CEST | 52492 | 23 | 192.168.2.13 | 98.75.219.105 |
| Apr 2, 2025 21:48:19.633841991 CEST | 52492 | 23 | 192.168.2.13 | 191.95.135.123 |
| Apr 2, 2025 21:48:19.633868933 CEST | 52492 | 23 | 192.168.2.13 | 175.156.155.113 |
| Apr 2, 2025 21:48:19.633876085 CEST | 52492 | 23 | 192.168.2.13 | 69.214.161.112 |
| Apr 2, 2025 21:48:19.633893967 CEST | 52492 | 23 | 192.168.2.13 | 183.130.120.176 |
| Apr 2, 2025 21:48:19.633909941 CEST | 52492 | 23 | 192.168.2.13 | 186.218.251.252 |
| Apr 2, 2025 21:48:19.633955002 CEST | 52492 | 23 | 192.168.2.13 | 139.167.214.205 |
| Apr 2, 2025 21:48:19.633971930 CEST | 52492 | 23 | 192.168.2.13 | 164.150.69.220 |
| Apr 2, 2025 21:48:19.634027958 CEST | 52492 | 23 | 192.168.2.13 | 54.114.231.98 |
| Apr 2, 2025 21:48:19.634052038 CEST | 52492 | 23 | 192.168.2.13 | 206.64.115.33 |
| Apr 2, 2025 21:48:19.634124994 CEST | 52492 | 23 | 192.168.2.13 | 14.179.184.201 |
| Apr 2, 2025 21:48:19.634139061 CEST | 52492 | 23 | 192.168.2.13 | 181.231.171.59 |
| Apr 2, 2025 21:48:19.634201050 CEST | 52492 | 23 | 192.168.2.13 | 199.108.151.31 |
| Apr 2, 2025 21:48:19.634217024 CEST | 52492 | 23 | 192.168.2.13 | 91.221.63.214 |
| Apr 2, 2025 21:48:19.634254932 CEST | 52492 | 23 | 192.168.2.13 | 183.75.245.103 |
| Apr 2, 2025 21:48:19.634273052 CEST | 52492 | 23 | 192.168.2.13 | 32.120.166.85 |
| Apr 2, 2025 21:48:19.634289980 CEST | 52492 | 23 | 192.168.2.13 | 99.185.4.139 |
| Apr 2, 2025 21:48:19.634303093 CEST | 52492 | 23 | 192.168.2.13 | 116.56.190.230 |
| Apr 2, 2025 21:48:19.634365082 CEST | 52492 | 23 | 192.168.2.13 | 192.219.160.1 |
| Apr 2, 2025 21:48:19.634406090 CEST | 52492 | 23 | 192.168.2.13 | 171.99.209.205 |
| Apr 2, 2025 21:48:19.634408951 CEST | 52492 | 23 | 192.168.2.13 | 77.186.103.75 |
| Apr 2, 2025 21:48:19.634418011 CEST | 52492 | 23 | 192.168.2.13 | 92.70.95.204 |
| Apr 2, 2025 21:48:19.634442091 CEST | 52492 | 23 | 192.168.2.13 | 221.239.64.54 |
| Apr 2, 2025 21:48:19.634475946 CEST | 52492 | 23 | 192.168.2.13 | 95.225.237.39 |
| Apr 2, 2025 21:48:19.634476900 CEST | 52492 | 23 | 192.168.2.13 | 92.66.63.74 |
| Apr 2, 2025 21:48:19.634509087 CEST | 52492 | 23 | 192.168.2.13 | 255.29.173.90 |
| Apr 2, 2025 21:48:19.634521961 CEST | 52492 | 23 | 192.168.2.13 | 206.204.146.3 |
| Apr 2, 2025 21:48:19.634529114 CEST | 52492 | 23 | 192.168.2.13 | 241.199.58.203 |
| Apr 2, 2025 21:48:19.634541035 CEST | 52492 | 23 | 192.168.2.13 | 109.234.28.182 |
| Apr 2, 2025 21:48:19.634562969 CEST | 52492 | 23 | 192.168.2.13 | 197.227.214.230 |
| Apr 2, 2025 21:48:19.634624958 CEST | 52492 | 23 | 192.168.2.13 | 172.95.72.121 |
| Apr 2, 2025 21:48:19.634625912 CEST | 52492 | 23 | 192.168.2.13 | 216.149.33.166 |
| Apr 2, 2025 21:48:19.634638071 CEST | 52492 | 23 | 192.168.2.13 | 83.63.223.1 |
| Apr 2, 2025 21:48:19.634720087 CEST | 52492 | 23 | 192.168.2.13 | 104.174.66.47 |
| Apr 2, 2025 21:48:19.634783030 CEST | 52492 | 23 | 192.168.2.13 | 64.30.36.79 |
| Apr 2, 2025 21:48:19.634809017 CEST | 52492 | 23 | 192.168.2.13 | 245.136.211.105 |
| Apr 2, 2025 21:48:19.634826899 CEST | 52492 | 23 | 192.168.2.13 | 142.48.49.185 |
| Apr 2, 2025 21:48:19.634840012 CEST | 52492 | 23 | 192.168.2.13 | 141.58.177.69 |
| Apr 2, 2025 21:48:19.634855986 CEST | 52492 | 23 | 192.168.2.13 | 133.222.200.221 |
| Apr 2, 2025 21:48:19.634869099 CEST | 52492 | 23 | 192.168.2.13 | 92.64.98.217 |
| Apr 2, 2025 21:48:19.634917974 CEST | 52492 | 23 | 192.168.2.13 | 44.153.151.136 |
| Apr 2, 2025 21:48:19.634917974 CEST | 52492 | 23 | 192.168.2.13 | 96.183.48.230 |
| Apr 2, 2025 21:48:19.634927988 CEST | 52492 | 23 | 192.168.2.13 | 162.52.129.115 |
| Apr 2, 2025 21:48:19.634939909 CEST | 52492 | 23 | 192.168.2.13 | 188.112.36.200 |
| Apr 2, 2025 21:48:19.634953022 CEST | 52492 | 23 | 192.168.2.13 | 154.221.65.176 |
| Apr 2, 2025 21:48:19.634963989 CEST | 52492 | 23 | 192.168.2.13 | 84.56.198.146 |
| Apr 2, 2025 21:48:19.634975910 CEST | 52492 | 23 | 192.168.2.13 | 61.108.123.1 |
| Apr 2, 2025 21:48:19.635016918 CEST | 52492 | 23 | 192.168.2.13 | 185.35.151.125 |
| Apr 2, 2025 21:48:19.635030985 CEST | 52492 | 23 | 192.168.2.13 | 45.16.142.91 |
| Apr 2, 2025 21:48:19.635047913 CEST | 52492 | 23 | 192.168.2.13 | 2.35.223.218 |
| Apr 2, 2025 21:48:19.635047913 CEST | 52492 | 23 | 192.168.2.13 | 53.135.181.4 |
| Apr 2, 2025 21:48:19.635066986 CEST | 52492 | 23 | 192.168.2.13 | 86.173.88.179 |
| Apr 2, 2025 21:48:19.635210991 CEST | 52492 | 23 | 192.168.2.13 | 168.66.225.187 |
| Apr 2, 2025 21:48:19.635292053 CEST | 52492 | 23 | 192.168.2.13 | 149.48.215.131 |
| Apr 2, 2025 21:48:19.635302067 CEST | 52492 | 23 | 192.168.2.13 | 121.110.71.88 |
| Apr 2, 2025 21:48:19.635364056 CEST | 52492 | 23 | 192.168.2.13 | 207.245.91.95 |
| Apr 2, 2025 21:48:19.635379076 CEST | 52492 | 23 | 192.168.2.13 | 59.173.136.152 |
| Apr 2, 2025 21:48:19.635400057 CEST | 52492 | 23 | 192.168.2.13 | 133.120.168.236 |
| Apr 2, 2025 21:48:19.635413885 CEST | 52492 | 23 | 192.168.2.13 | 53.153.189.24 |
| Apr 2, 2025 21:48:19.635500908 CEST | 52492 | 23 | 192.168.2.13 | 108.221.193.176 |
| Apr 2, 2025 21:48:19.635504007 CEST | 52492 | 23 | 192.168.2.13 | 152.108.244.33 |
| Apr 2, 2025 21:48:19.635513067 CEST | 52492 | 23 | 192.168.2.13 | 12.12.208.151 |
| Apr 2, 2025 21:48:19.635576963 CEST | 52492 | 23 | 192.168.2.13 | 8.51.252.70 |
| Apr 2, 2025 21:48:19.635584116 CEST | 52492 | 23 | 192.168.2.13 | 159.43.209.219 |
| Apr 2, 2025 21:48:19.635591030 CEST | 52492 | 23 | 192.168.2.13 | 9.156.171.70 |
| Apr 2, 2025 21:48:19.635617971 CEST | 52492 | 23 | 192.168.2.13 | 64.9.22.52 |
| Apr 2, 2025 21:48:19.635643959 CEST | 52492 | 23 | 192.168.2.13 | 108.114.132.195 |
| Apr 2, 2025 21:48:19.635752916 CEST | 52492 | 23 | 192.168.2.13 | 201.141.90.238 |
| Apr 2, 2025 21:48:19.635757923 CEST | 52492 | 23 | 192.168.2.13 | 170.8.151.38 |
| Apr 2, 2025 21:48:19.826246977 CEST | 7887 | 52646 | 213.209.129.92 | 192.168.2.13 |
| Apr 2, 2025 21:48:19.826338053 CEST | 52646 | 7887 | 192.168.2.13 | 213.209.129.92 |
| Apr 2, 2025 21:48:20.175919056 CEST | 52646 | 7887 | 192.168.2.13 | 213.209.129.92 |
| Apr 2, 2025 21:48:20.402911901 CEST | 7887 | 52646 | 213.209.129.92 | 192.168.2.13 |
| Apr 2, 2025 21:48:20.402991056 CEST | 52646 | 7887 | 192.168.2.13 | 213.209.129.92 |
| Timestamp | Source IP | Dest IP | Checksum | Code | Type |
|---|---|---|---|---|---|
| Apr 2, 2025 21:48:46.457109928 CEST | 192.168.2.13 | 192.168.2.1 | 8279 | (Port unreachable) | Destination Unreachable |
| Apr 2, 2025 21:50:06.472376108 CEST | 192.168.2.13 | 192.168.2.1 | 8279 | (Port unreachable) | Destination Unreachable |
System Behavior
| Start time (UTC): | 19:48:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.powerpc-440fp.elf |
| Arguments: | /tmp/xd.powerpc-440fp.elf |
| File size: | 5388968 bytes |
| MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
| Start time (UTC): | 19:48:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.powerpc-440fp.elf |
| Arguments: | - |
| File size: | 5388968 bytes |
| MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
| Start time (UTC): | 19:48:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.powerpc-440fp.elf |
| Arguments: | - |
| File size: | 5388968 bytes |
| MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
| Start time (UTC): | 19:48:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.powerpc-440fp.elf |
| Arguments: | - |
| File size: | 5388968 bytes |
| MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
| Start time (UTC): | 19:48:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.powerpc-440fp.elf |
| Arguments: | - |
| File size: | 5388968 bytes |
| MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
| Start time (UTC): | 19:48:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.powerpc-440fp.elf |
| Arguments: | - |
| File size: | 5388968 bytes |
| MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
| Start time (UTC): | 19:48:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.powerpc-440fp.elf |
| Arguments: | - |
| File size: | 5388968 bytes |
| MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
| Start time (UTC): | 19:48:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/journalctl |
| Arguments: | /usr/bin/journalctl --smart-relinquish-var |
| File size: | 80120 bytes |
| MD5 hash: | bf3a987344f3bacafc44efd882abda8b |
| Start time (UTC): | 19:48:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/pulseaudio |
| Arguments: | /usr/bin/pulseaudio --daemonize=no --log-target=journal |
| File size: | 100832 bytes |
| MD5 hash: | 0c3b4c789d8ffb12b25507f27e14c186 |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/sbin/gdm3 |
| Arguments: | - |
| File size: | 453296 bytes |
| MD5 hash: | 2492e2d8d34f9377e3e530a61a15674f |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /etc/gdm3/PrimeOff/Default |
| Arguments: | /etc/gdm3/PrimeOff/Default |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/sbin/gdm3 |
| Arguments: | - |
| File size: | 453296 bytes |
| MD5 hash: | 2492e2d8d34f9377e3e530a61a15674f |
| Start time (UTC): | 19:48:42 |
| Start date (UTC): | 02/04/2025 |
| Path: | /etc/gdm3/PrimeOff/Default |
| Arguments: | /etc/gdm3/PrimeOff/Default |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:43 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/sbin/gdm3 |
| Arguments: | - |
| File size: | 453296 bytes |
| MD5 hash: | 2492e2d8d34f9377e3e530a61a15674f |
| Start time (UTC): | 19:48:43 |
| Start date (UTC): | 02/04/2025 |
| Path: | /etc/gdm3/PrimeOff/Default |
| Arguments: | /etc/gdm3/PrimeOff/Default |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:43 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:43 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:43 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:43 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:44 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 19:48:45 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:45 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:45 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:45 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 19:48:45 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:48:45 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:45 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:45 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 19:48:46 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:46 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/share/gdm/generate-config |
| Arguments: | /usr/share/gdm/generate-config |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:46 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/share/gdm/generate-config |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 19:48:46 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/pkill |
| Arguments: | pkill --signal HUP --uid gdm dconf-service |
| File size: | 30968 bytes |
| MD5 hash: | fa96a75a08109d8842e4865b2907d51f |
| Start time (UTC): | 19:48:47 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/libexec/gvfsd-fuse |
| Arguments: | - |
| File size: | 47632 bytes |
| MD5 hash: | d18fbf1cbf8eb57b17fac48b7b4be933 |
| Start time (UTC): | 19:48:47 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/fusermount |
| Arguments: | fusermount -u -q -z -- /run/user/1000/gvfs |
| File size: | 39144 bytes |
| MD5 hash: | 576a1b135c82bdcbc97a91acea900566 |
| Start time (UTC): | 19:48:47 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:47 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/gdm3/gdm-wait-for-drm |
| Arguments: | /usr/lib/gdm3/gdm-wait-for-drm |
| File size: | 14640 bytes |
| MD5 hash: | 82043ba752c6930b4e6aaea2f7747545 |
| Start time (UTC): | 19:48:58 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:58 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/sbin/gdm3 |
| Arguments: | /usr/sbin/gdm3 |
| File size: | 453296 bytes |
| MD5 hash: | 2492e2d8d34f9377e3e530a61a15674f |
| Start time (UTC): | 19:48:58 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:58 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:58 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:58 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:48:58 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:12 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:13 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:14 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:16 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:18 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:19 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 19:49:20 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:21 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 19:49:21 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/plymouth |
| Arguments: | /bin/plymouth quit |
| File size: | 51352 bytes |
| MD5 hash: | 87003efd8dad470042f5e75360a8f49f |
| Start time (UTC): | 19:50:17 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
