Create Interactive Tour
Linux
Analysis Report
xd.mpsl.elf
Overview
General Information
| Sample name: | xd.mpsl.elf |
| Analysis ID: | 1655055 |
| MD5: | 0a450ed1af6d7859d660cb5493e5ca88 |
| SHA1: | bc664793ae8b447fa7297e99c6e04ccb4a02bd96 |
| SHA256: | 5139565baf80cdd3a237fbf73d787096cf0ef7f41a32eb8af7b20383fd9efab7 |
| Tags: | elfuser-abuse_ch |
| Infos: |  |
Detection
Mirai
| Score: | 100 |
| Range: | 0 - 100 |
Signatures
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample deletes itself
Sample is packed with UPX
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Deletes log files
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Executes the "rm" command used to delete files or directories
Reads CPU information from /sys indicative of miner or evasive malware
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match
Classification
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1655055 |
| Start date and time: | 2025-04-02 22:23:37 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 37s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultlinuxfilecookbook.jbs |
| Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
| Analysis Mode: | default |
| Sample name: | xd.mpsl.elf |
| Detection: | MAL |
| Classification: | mal100.spre.troj.evad.linELF@0/16@0/0 |
- Connection to analysis system has been lost, crash info: Unknown
- system is lnxubuntu20
- xd.mpsl.elf New Fork (PID: 5434, Parent: 5432)
- xd.mpsl.elf New Fork (PID: 5436, Parent: 5432)
- xd.mpsl.elf New Fork (PID: 5438, Parent: 5432)
- xd.mpsl.elf New Fork (PID: 5442, Parent: 5438)
- xd.mpsl.elf New Fork (PID: 5446, Parent: 5438)
- xd.mpsl.elf New Fork (PID: 5449, Parent: 5438)
- systemd New Fork (PID: 5466, Parent: 1)
- systemd New Fork (PID: 5480, Parent: 1)
- systemd New Fork (PID: 5481, Parent: 1)
- systemd New Fork (PID: 5482, Parent: 1)
- systemd New Fork (PID: 5483, Parent: 1)
- systemd New Fork (PID: 5484, Parent: 1)
- systemd New Fork (PID: 5539, Parent: 1)
- systemd New Fork (PID: 5540, Parent: 1)
- systemd New Fork (PID: 5543, Parent: 1)
- systemd New Fork (PID: 5545, Parent: 1)
- systemd New Fork (PID: 5546, Parent: 1)
- systemd New Fork (PID: 5547, Parent: 1)
- systemd New Fork (PID: 5548, Parent: 1)
- systemd New Fork (PID: 5549, Parent: 2935)
- gdm3 New Fork (PID: 5550, Parent: 1400)
- gdm3 New Fork (PID: 5551, Parent: 1400)
- gdm3 New Fork (PID: 5552, Parent: 1400)
- systemd New Fork (PID: 5553, Parent: 1)
- systemd New Fork (PID: 5555, Parent: 1)
- systemd New Fork (PID: 5556, Parent: 1)
- systemd New Fork (PID: 5558, Parent: 1)
- gpu-manager New Fork (PID: 5559, Parent: 5558)
- sh New Fork (PID: 5560, Parent: 5559)
- gpu-manager New Fork (PID: 5561, Parent: 5558)
- sh New Fork (PID: 5562, Parent: 5561)
- gpu-manager New Fork (PID: 5563, Parent: 5558)
- sh New Fork (PID: 5564, Parent: 5563)
- gpu-manager New Fork (PID: 5565, Parent: 5558)
- sh New Fork (PID: 5566, Parent: 5565)
- gpu-manager New Fork (PID: 5567, Parent: 5558)
- sh New Fork (PID: 5568, Parent: 5567)
- gpu-manager New Fork (PID: 5569, Parent: 5558)
- sh New Fork (PID: 5570, Parent: 5569)
- gpu-manager New Fork (PID: 5571, Parent: 5558)
- sh New Fork (PID: 5572, Parent: 5571)
- gpu-manager New Fork (PID: 5573, Parent: 5558)
- sh New Fork (PID: 5574, Parent: 5573)
- systemd New Fork (PID: 5575, Parent: 1)
- generate-config New Fork (PID: 5576, Parent: 5575)
- systemd (deleted) New Fork (PID: 5577, Parent: 1)
- gvfsd-fuse New Fork (PID: 5578, Parent: 3122)
- dash New Fork (PID: 5582, Parent: 3578)
- dash New Fork (PID: 5583, Parent: 3578)
- systemd (deleted) New Fork (PID: 5584, Parent: 1)
- systemd (deleted) New Fork (PID: 5587, Parent: 1)
- systemd (deleted) New Fork (PID: 5595, Parent: 1)
- systemd (deleted) New Fork (PID: 5596, Parent: 1)
- systemd (deleted) New Fork (PID: 5602, Parent: 1)
- systemd (deleted) New Fork (PID: 5603, Parent: 1)
- systemd (deleted) New Fork (PID: 5604, Parent: 1)
- gpu-manager New Fork (PID: 5605, Parent: 5604)
- gpu-manager New Fork (PID: 5606, Parent: 5604)
- gpu-manager New Fork (PID: 5607, Parent: 5604)
- gpu-manager New Fork (PID: 5608, Parent: 5604)
- gpu-manager New Fork (PID: 5609, Parent: 5604)
- gpu-manager New Fork (PID: 5610, Parent: 5604)
- gpu-manager New Fork (PID: 5611, Parent: 5604)
- gpu-manager New Fork (PID: 5612, Parent: 5604)
- systemd (deleted) New Fork (PID: 5613, Parent: 1)
- systemd (deleted) New Fork (PID: 5614, Parent: 1)
- gpu-manager New Fork (PID: 5615, Parent: 5614)
- gpu-manager New Fork (PID: 5616, Parent: 5614)
- gpu-manager New Fork (PID: 5617, Parent: 5614)
- gpu-manager New Fork (PID: 5618, Parent: 5614)
- gpu-manager New Fork (PID: 5619, Parent: 5614)
- gpu-manager New Fork (PID: 5620, Parent: 5614)
- gpu-manager New Fork (PID: 5621, Parent: 5614)
- gpu-manager New Fork (PID: 5622, Parent: 5614)
- systemd (deleted) New Fork (PID: 5623, Parent: 1)
- systemd (deleted) New Fork (PID: 5624, Parent: 1)
- gpu-manager New Fork (PID: 5625, Parent: 5624)
- gpu-manager New Fork (PID: 5626, Parent: 5624)
- gpu-manager New Fork (PID: 5627, Parent: 5624)
- gpu-manager New Fork (PID: 5628, Parent: 5624)
- gpu-manager New Fork (PID: 5629, Parent: 5624)
- gpu-manager New Fork (PID: 5630, Parent: 5624)
- gpu-manager New Fork (PID: 5631, Parent: 5624)
- gpu-manager New Fork (PID: 5632, Parent: 5624)
- systemd (deleted) New Fork (PID: 5633, Parent: 1)
- systemd (deleted) New Fork (PID: 5634, Parent: 1)
- gpu-manager New Fork (PID: 5635, Parent: 5634)
- gpu-manager New Fork (PID: 5636, Parent: 5634)
- gpu-manager New Fork (PID: 5637, Parent: 5634)
- gpu-manager New Fork (PID: 5638, Parent: 5634)
- gpu-manager New Fork (PID: 5639, Parent: 5634)
- gpu-manager New Fork (PID: 5640, Parent: 5634)
- gpu-manager New Fork (PID: 5641, Parent: 5634)
- gpu-manager New Fork (PID: 5642, Parent: 5634)
- systemd (deleted) New Fork (PID: 5643, Parent: 1)
- systemd (deleted) New Fork (PID: 5644, Parent: 1)
- gpu-manager New Fork (PID: 5645, Parent: 5644)
- gpu-manager New Fork (PID: 5646, Parent: 5644)
- gpu-manager New Fork (PID: 5647, Parent: 5644)
- gpu-manager New Fork (PID: 5648, Parent: 5644)
- gpu-manager New Fork (PID: 5649, Parent: 5644)
- gpu-manager New Fork (PID: 5650, Parent: 5644)
- gpu-manager New Fork (PID: 5651, Parent: 5644)
- gpu-manager New Fork (PID: 5652, Parent: 5644)
- systemd (deleted) New Fork (PID: 5653, Parent: 1)
- systemd (deleted) New Fork (PID: 5654, Parent: 1)
- systemd (deleted) New Fork (PID: 5656, Parent: 2935)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Mirai | Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. | No Attribution |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Mirai_9 | Yara detected Mirai | Joe Security | ||
| JoeSecurity_Mirai_5 | Yara detected Mirai | Joe Security | ||
| JoeSecurity_Mirai_8 | Yara detected Mirai | Joe Security | ||
| Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
| Linux_Trojan_Gafgyt_ea92cca8 | unknown | unknown |
| |
| Click to see the 61 entries | ||||
⊘No Suricata rule has matched
- • AV Detection
- • Bitcoin Miner
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Stealing of Sensitive Information
- • Remote Access Functionality
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | ReversingLabs: | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | TCP traffic: | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | Socket: | Jump to behavior | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | Program segment: | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | SIGKILL sent: | Jump to behavior | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
Data Obfuscation | |
|---|
| Source: | String containing UPX found: | ||
| Source: | String containing UPX found: | ||
| Source: | String containing UPX found: | ||
Persistence and Installation Behavior | |
|---|
| Source: | File: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Grep executable: | Jump to behavior | ||
| Source: | Pkill executable: | Jump to behavior | ||
| Source: | Rm executable: | Jump to behavior | ||
| Source: | Rm executable: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | Log file created: | |||
| Source: | Log file created: | |||
| Source: | Log file created: | |||
| Source: | Log file created: | |||
| Source: | Log file created: | |||
| Source: | Log file created: | Jump to dropped file | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | File: | Jump to behavior | ||
| Source: | Submission file: | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | Reads CPU info from /sys: | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | Windows Management Instrumentation | 1 Scripting | Path Interception | 1 File and Directory Permissions Modification | 1 OS Credential Dumping | 11 Security Software Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | 1 Service Stop |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Disable or Modify Tools | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 11 Obfuscated Files or Information | Security Account Manager | 1 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Indicator Removal | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 11 File Deletion | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
⊘No configs have been found
Is Dropped
Number of created Files
Is malicious
Internet| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 47% | ReversingLabs | Linux.Trojan.Mirai | ||
| 100% | Avira | EXP/ELF.Agent.M.28 |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 97.62.209.101 | unknown | United States | 22394 | CELLCOUS | false | |
| 119.203.10.181 | unknown | Korea Republic of | 4766 | KIXS-AS-KRKoreaTelecomKR | false | |
| 86.125.177.22 | unknown | Romania | 8708 | RCS-RDS73-75DrStaicoviciRO | false | |
| 180.117.61.248 | unknown | China | 137702 | CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince | false | |
| 208.87.9.44 | unknown | United States | 22107 | COLLABNETUS | false | |
| 2.61.155.91 | unknown | Russian Federation | 12389 | ROSTELECOM-ASRU | false | |
| 99.195.58.224 | unknown | United States | 22561 | CENTURYLINK-LEGACY-LIGHTCOREUS | false | |
| 109.137.220.217 | unknown | Belgium | 5432 | PROXIMUS-ISP-ASBE | false | |
| 104.45.164.55 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 192.138.242.154 | unknown | United States | 393902 | CIC-PLUS-INCUS | false | |
| 16.243.109.221 | unknown | United States | unknown | unknown | false | |
| 192.243.145.59 | unknown | United States | 22284 | AS22284-DOI-OPSUS | false | |
| 211.62.217.24 | unknown | Korea Republic of | 3786 | LGDACOMLGDACOMCorporationKR | false | |
| 123.175.214.49 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false | |
| 38.142.138.76 | unknown | United States | 174 | COGENT-174US | false | |
| 182.254.0.207 | unknown | China | 45090 | CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa | false | |
| 24.181.109.112 | unknown | United States | 20115 | CHARTER-20115US | false | |
| 113.244.94.110 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false | |
| 155.89.78.12 | unknown | Angola | 37081 | movicel-asAO | false | |
| 106.152.236.194 | unknown | Japan | 2516 | KDDIKDDICORPORATIONJP | false | |
| 165.82.14.146 | unknown | United States | 3777 | HAVERFORDUS | false | |
| 63.161.244.199 | unknown | United States | 1239 | SPRINTLINKUS | false | |
| 150.251.116.154 | unknown | Belgium | 48647 | SOLVAYNL | false | |
| 210.61.175.22 | unknown | Taiwan; Republic of China (ROC) | 3462 | HINETDataCommunicationBusinessGroupTW | false | |
| 97.18.251.177 | unknown | United States | 22394 | CELLCOUS | false | |
| 109.111.166.193 | unknown | Russian Federation | 40995 | SIBSET-NKZ-ASRU | false | |
| 197.93.232.222 | unknown | South Africa | 10474 | OPTINETZA | false | |
| 206.15.115.110 | unknown | United States | 5088 | AS5088US | false | |
| 141.49.34.44 | unknown | Germany | 60344 | ASKLEPIOS-ASDE | false | |
| 32.124.107.121 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 181.46.167.154 | unknown | Argentina | 27747 | TelecentroSAAR | false | |
| 45.245.237.178 | unknown | Egypt | 24863 | LINKdotNET-ASEG | false | |
| 179.228.199.52 | unknown | Brazil | 27699 | TELEFONICABRASILSABR | false | |
| 222.55.102.165 | unknown | China | 9394 | CTTNETChinaTieTongTelecommunicationsCorporationCN | false | |
| 47.92.114.226 | unknown | China | 37963 | CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd | false | |
| 90.115.153.192 | unknown | France | 3215 | FranceTelecom-OrangeFR | false | |
| 71.24.101.190 | unknown | United States | 7922 | COMCAST-7922US | false | |
| 71.13.230.103 | unknown | United States | 20115 | CHARTER-20115US | false | |
| 72.229.209.226 | unknown | United States | 12271 | TWC-12271-NYCUS | false | |
| 106.73.18.109 | unknown | Japan | 2516 | KDDIKDDICORPORATIONJP | false | |
| 111.60.66.239 | unknown | China | 9808 | CMNET-GDGuangdongMobileCommunicationCoLtdCN | false | |
| 185.28.112.152 | unknown | United Kingdom | 60228 | C24-ASGB | false | |
| 254.233.232.240 | unknown | Reserved | unknown | unknown | false | |
| 83.37.26.41 | unknown | Spain | 3352 | TELEFONICA_DE_ESPANAES | false | |
| 13.208.36.79 | unknown | United States | 16509 | AMAZON-02US | false | |
| 12.53.0.241 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 253.87.186.79 | unknown | Reserved | unknown | unknown | false | |
| 198.28.95.213 | unknown | United States | 3902 | GLAXOSMITHKLINEUS | false | |
| 187.12.132.94 | unknown | Brazil | 7738 | TelemarNorteLesteSABR | false | |
| 12.175.207.62 | unknown | United States | 7018 | ATT-INTERNET4US | false | |
| 242.141.230.173 | unknown | Reserved | unknown | unknown | false | |
| 204.37.135.91 | unknown | United States | 1580 | DNIC-ASBLK-01550-01601US | false | |
| 150.108.253.187 | unknown | United States | 32531 | FORDHAM-UNIVERSITYUS | false | |
| 248.193.88.141 | unknown | Reserved | unknown | unknown | false | |
| 247.214.74.59 | unknown | Reserved | unknown | unknown | false | |
| 141.108.113.41 | unknown | Italy | 137 | ASGARRConsortiumGARREU | false | |
| 207.233.127.98 | unknown | United States | 2152 | CSUNET-NWUS | false | |
| 47.11.249.16 | unknown | India | 55836 | RELIANCEJIO-INRelianceJioInfocommLimitedIN | false | |
| 4.97.44.22 | unknown | United States | 3356 | LEVEL3US | false | |
| 85.220.230.68 | unknown | Germany | 25394 | MK-NETZDIENSTE-ASDE | false | |
| 101.47.181.207 | unknown | China | 131536 | SHGWBNNETShanghaiGreatWallBroadbandNetworkServiceCo | false | |
| 223.214.236.67 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false | |
| 249.235.230.125 | unknown | Reserved | unknown | unknown | false | |
| 47.150.231.88 | unknown | United States | 5650 | FRONTIER-FRTRUS | false | |
| 167.167.167.168 | unknown | United States | 59447 | SAYFANETTR | false | |
| 41.174.93.32 | unknown | South Africa | 30969 | ZOL-ASGB | false | |
| 117.234.162.255 | unknown | India | 9829 | BSNL-NIBNationalInternetBackboneIN | false | |
| 178.104.82.212 | unknown | United Kingdom | 12576 | EELtdGB | false | |
| 69.190.220.200 | unknown | United States | 3801 | MISNETUS | false | |
| 102.172.209.25 | unknown | Tunisia | 37693 | TUNISIANATN | false | |
| 220.95.23.25 | unknown | Korea Republic of | 4766 | KIXS-AS-KRKoreaTelecomKR | false | |
| 189.146.142.12 | unknown | Mexico | 8151 | UninetSAdeCVMX | false | |
| 40.151.101.148 | unknown | United States | 4249 | LILLY-ASUS | false | |
| 213.209.129.92 | unknown | Germany | 42821 | RAPIDNET-DEHaunstetterStr19DE | false | |
| 63.16.233.138 | unknown | United States | 701 | UUNETUS | false | |
| 79.166.195.224 | unknown | Greece | 3329 | HOL-GRAthensGreeceGR | false | |
| 19.5.27.105 | unknown | United States | 3 | MIT-GATEWAYSUS | false | |
| 223.76.14.186 | unknown | China | 9808 | CMNET-GDGuangdongMobileCommunicationCoLtdCN | false | |
| 187.49.191.145 | unknown | unknown | 269973 | OLANCHONETSRLDECVHN | false | |
| 89.189.176.46 | unknown | Russian Federation | 34757 | SIBSET-NSK-ASRU | false | |
| 85.239.102.98 | unknown | Germany | 16097 | HLKOMM04107LeipzigDE | false | |
| 182.213.177.216 | unknown | Korea Republic of | 17858 | POWERVIS-AS-KRLGPOWERCOMMKR | false | |
| 83.176.241.214 | unknown | Sweden | 1257 | TELE2EU | false | |
| 67.188.100.213 | unknown | United States | 7922 | COMCAST-7922US | false | |
| 153.75.181.56 | unknown | United States | 14962 | NCR-252US | false | |
| 213.218.209.36 | unknown | United Kingdom | 8851 | EDGEtaGCIComGB | false | |
| 155.193.156.43 | unknown | Reserved | 8698 | NationwideBuildingSocietyGB | false | |
| 152.93.124.9 | unknown | Norway | 25400 | TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO | false | |
| 250.224.5.163 | unknown | Reserved | unknown | unknown | false | |
| 159.23.72.247 | unknown | United States | 36351 | SOFTLAYERUS | false | |
| 196.138.10.47 | unknown | Egypt | 36935 | Vodafone-EG | false | |
| 219.138.124.41 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false | |
| 152.189.207.148 | unknown | United States | 701 | UUNETUS | false | |
| 175.93.126.134 | unknown | China | 9394 | CTTNETChinaTieTongTelecommunicationsCorporationCN | false | |
| 8.155.63.182 | unknown | Singapore | 37963 | CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd | false | |
| 143.4.0.72 | unknown | United States | 11003 | PANDGUS | false | |
| 5.51.226.254 | unknown | France | 5410 | BOUYGTEL-ISPFR | false | |
| 100.59.85.209 | unknown | United States | 701 | UUNETUS | false | |
| 41.29.25.209 | unknown | South Africa | 29975 | VODACOM-ZA | false | |
| 123.186.87.113 | unknown | China | 4134 | CHINANET-BACKBONENo31Jin-rongStreetCN | false |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CELLCOUS | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| KIXS-AS-KRKoreaTelecomKR | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| RCS-RDS73-75DrStaicoviciRO | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Gafgyt, Okiru | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Okiru | Browse |
|
⊘No context
⊘No context
| Process: | /usr/bin/pulseaudio |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10 |
| Entropy (8bit): | 2.9219280948873623 |
| Encrypted: | false |
| SSDEEP: | 3:5bkPn:pkP |
| MD5: | FF001A15CE15CF062A3704CEA2991B5F |
| SHA1: | B06F6855F376C3245B82212AC73ADED55DFE5DEF |
| SHA-256: | C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A |
| SHA-512: | 65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | /usr/bin/pulseaudio |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 18 |
| Entropy (8bit): | 3.4613201402110088 |
| Encrypted: | false |
| SSDEEP: | 3:5bkrIZsXvn:pkckv |
| MD5: | 28FE6435F34B3367707BB1C5D5F6B430 |
| SHA1: | EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6 |
| SHA-256: | 721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0 |
| SHA-512: | 6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | /usr/sbin/gdm3 |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5 |
| Entropy (8bit): | 1.9219280948873623 |
| Encrypted: | false |
| SSDEEP: | 3:FdJn:nJn |
| MD5: | 531EC9267EFDC9B27A218411F60559B0 |
| SHA1: | 4B3852666367821A309AEE2D9B399354C9B18D5B |
| SHA-256: | 0819FB915F438E87B3553B0E74D2EB4B873F1A9857824DEFA3CF77DD9F237BF6 |
| SHA-512: | CE9712D908071E718EB4FEA775002FD2B20A4C1F109DA2059FD766079CF432223F05CAC59635B8C18A7552E1085C80B4387ED4F3248D9A4769F6936C41DDC70C |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | /usr/bin/pulseaudio |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5 |
| Entropy (8bit): | 1.9219280948873623 |
| Encrypted: | false |
| SSDEEP: | 3:FRe:re |
| MD5: | 1CA8DD7435C07B05CE29DFE438579AE5 |
| SHA1: | 59E8B3F00C71D6C4E8500A8B5A3E548507694804 |
| SHA-256: | 32308DC1BB41642AB1879D0B84ABD1BFBC9A9F333EE742008539BC42E4D6E964 |
| SHA-512: | 60A870B0D16E0873FCF8177F12483080982E45D6A2EFD0D29DAE255D7403CCC4D7BDB75158AEAF4B9F8E4ABDF5AC64A83E057BA8BE3FC66C84EFCD7DDC2EEE16 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | /usr/bin/gpu-manager |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 25 |
| Entropy (8bit): | 2.7550849518197795 |
| Encrypted: | false |
| SSDEEP: | 3:JoT/V9fDVbn:M/V3n |
| MD5: | 078760523943E160756979906B85FB5E |
| SHA1: | 0962643266F4C5537F7D125046F28F21D6DD0C89 |
| SHA-256: | 048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C |
| SHA-512: | DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | /usr/bin/gpu-manager |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1371 |
| Entropy (8bit): | 4.8296848499188485 |
| Encrypted: | false |
| SSDEEP: | 24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O |
| MD5: | 3AF77E630DA00B3BE24F4E8AA5D78B13 |
| SHA1: | BCF2D99E002F6DE2413A183227B011CFBEF5673D |
| SHA-256: | EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA |
| SHA-512: | 8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.904969656800203 |
| TrID: |
|
| File name: | xd.mpsl.elf |
| File size: | 32'032 bytes |
| MD5: | 0a450ed1af6d7859d660cb5493e5ca88 |
| SHA1: | bc664793ae8b447fa7297e99c6e04ccb4a02bd96 |
| SHA256: | 5139565baf80cdd3a237fbf73d787096cf0ef7f41a32eb8af7b20383fd9efab7 |
| SHA512: | 3449adc9c822f711c472e0eff786bfcce4510c838abd9e231b7fe45fe986dd20eb807a8ae1968338748969e40e23c00a8431abae3c26648d63b930126a800f8a |
| SSDEEP: | 768:DsYsX5pv9AfHSOiGiH1MqM59bbfLXODdiCWY:4Ysfv6fXBqYbbfL+Ddb |
| TLSH: | 61E2D0EF57451C91C9EE0CBE50AD06C4F924F1F222EC4B9ED71298CAE52C692FD490B4 |
| File Content Preview: | .ELF.....................h..4...........4. ...(......................{...{..............Xk..XkE.XkE...................+.UPX!`........h...h......T..........?.E.h;....#......b.L#8..9I.N.5.K..N.-^.....q.):..pJ.........$....+y.r..W.qh......<U...d............. |
ELF header | |
|---|---|
| Class: | |
| Data: | |
| Version: | |
| Machine: | |
| Version Number: | |
| Type: | |
| OS/ABI: | |
| ABI Version: | 0 |
| Entry Point Address: | |
| Flags: | |
| ELF Header Size: | 52 |
| Program Header Offset: | 52 |
| Program Header Size: | 32 |
| Number of Program Headers: | 2 |
| Section Header Offset: | 0 |
| Section Header Size: | 40 |
| Number of Section Headers: | 0 |
| Header String Table Index: | 0 |
| Type | Offset | Virtual Address | Physical Address | File Size | Memory Size | Entropy | Flags | Flags Description | Align | Prog Interpreter | Section Mappings |
|---|---|---|---|---|---|---|---|---|---|---|---|
| LOAD | 0x0 | 0x100000 | 0x100000 | 0x7bdd | 0x7bdd | 7.9083 | 0x5 | R E | 0x10000 | ||
| LOAD | 0x6b58 | 0x456b58 | 0x456b58 | 0x0 | 0x0 | 0.0000 | 0x6 | RW | 0x10000 |
Download Network PCAP: filtered – full
- Total Packets: 155
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Apr 2, 2025 22:24:24.505034924 CEST | 52644 | 7887 | 192.168.2.13 | 213.209.129.92 |
| Apr 2, 2025 22:24:24.514775038 CEST | 42030 | 23 | 192.168.2.13 | 14.84.119.9 |
| Apr 2, 2025 22:24:24.516333103 CEST | 42030 | 23 | 192.168.2.13 | 152.93.124.9 |
| Apr 2, 2025 22:24:24.516419888 CEST | 42030 | 23 | 192.168.2.13 | 222.223.55.255 |
| Apr 2, 2025 22:24:24.516419888 CEST | 42030 | 23 | 192.168.2.13 | 4.97.44.22 |
| Apr 2, 2025 22:24:24.516426086 CEST | 42030 | 23 | 192.168.2.13 | 109.111.166.193 |
| Apr 2, 2025 22:24:24.516444921 CEST | 42030 | 23 | 192.168.2.13 | 122.4.160.198 |
| Apr 2, 2025 22:24:24.516509056 CEST | 42030 | 23 | 192.168.2.13 | 45.245.237.178 |
| Apr 2, 2025 22:24:24.516519070 CEST | 42030 | 23 | 192.168.2.13 | 90.115.153.192 |
| Apr 2, 2025 22:24:24.516545057 CEST | 42030 | 23 | 192.168.2.13 | 47.11.249.16 |
| Apr 2, 2025 22:24:24.516549110 CEST | 42030 | 23 | 192.168.2.13 | 190.252.140.36 |
| Apr 2, 2025 22:24:24.516551971 CEST | 42030 | 23 | 192.168.2.13 | 196.23.175.62 |
| Apr 2, 2025 22:24:24.516825914 CEST | 42030 | 23 | 192.168.2.13 | 47.92.114.226 |
| Apr 2, 2025 22:24:24.516829967 CEST | 42030 | 23 | 192.168.2.13 | 142.133.2.248 |
| Apr 2, 2025 22:24:24.516829967 CEST | 42030 | 23 | 192.168.2.13 | 2.61.155.91 |
| Apr 2, 2025 22:24:24.516829967 CEST | 42030 | 23 | 192.168.2.13 | 198.28.95.213 |
| Apr 2, 2025 22:24:24.516830921 CEST | 42030 | 23 | 192.168.2.13 | 38.142.138.76 |
| Apr 2, 2025 22:24:24.516829967 CEST | 42030 | 23 | 192.168.2.13 | 182.213.177.216 |
| Apr 2, 2025 22:24:24.516832113 CEST | 42030 | 23 | 192.168.2.13 | 95.177.191.224 |
| Apr 2, 2025 22:24:24.516834974 CEST | 42030 | 23 | 192.168.2.13 | 182.254.0.207 |
| Apr 2, 2025 22:24:24.516835928 CEST | 42030 | 23 | 192.168.2.13 | 48.164.220.253 |
| Apr 2, 2025 22:24:24.516835928 CEST | 42030 | 23 | 192.168.2.13 | 115.68.124.126 |
| Apr 2, 2025 22:24:24.516836882 CEST | 42030 | 23 | 192.168.2.13 | 14.170.155.177 |
| Apr 2, 2025 22:24:24.516849041 CEST | 42030 | 23 | 192.168.2.13 | 119.203.10.181 |
| Apr 2, 2025 22:24:24.516849995 CEST | 42030 | 23 | 192.168.2.13 | 63.161.244.199 |
| Apr 2, 2025 22:24:24.516855001 CEST | 42030 | 23 | 192.168.2.13 | 80.253.101.182 |
| Apr 2, 2025 22:24:24.516860008 CEST | 42030 | 23 | 192.168.2.13 | 207.233.127.98 |
| Apr 2, 2025 22:24:24.516860008 CEST | 42030 | 23 | 192.168.2.13 | 150.251.116.154 |
| Apr 2, 2025 22:24:24.516860008 CEST | 42030 | 23 | 192.168.2.13 | 192.243.145.59 |
| Apr 2, 2025 22:24:24.516860962 CEST | 42030 | 23 | 192.168.2.13 | 206.15.115.110 |
| Apr 2, 2025 22:24:24.516860008 CEST | 42030 | 23 | 192.168.2.13 | 207.168.136.247 |
| Apr 2, 2025 22:24:24.516860962 CEST | 42030 | 23 | 192.168.2.13 | 1.117.25.77 |
| Apr 2, 2025 22:24:24.516860008 CEST | 42030 | 23 | 192.168.2.13 | 93.127.151.156 |
| Apr 2, 2025 22:24:24.516860008 CEST | 42030 | 23 | 192.168.2.13 | 123.175.214.49 |
| Apr 2, 2025 22:24:24.516860008 CEST | 42030 | 23 | 192.168.2.13 | 250.224.5.163 |
| Apr 2, 2025 22:24:24.516860008 CEST | 42030 | 23 | 192.168.2.13 | 86.90.190.65 |
| Apr 2, 2025 22:24:24.516879082 CEST | 42030 | 23 | 192.168.2.13 | 189.146.142.12 |
| Apr 2, 2025 22:24:24.516879082 CEST | 42030 | 23 | 192.168.2.13 | 205.246.98.139 |
| Apr 2, 2025 22:24:24.516884089 CEST | 42030 | 23 | 192.168.2.13 | 75.11.20.93 |
| Apr 2, 2025 22:24:24.516901016 CEST | 42030 | 23 | 192.168.2.13 | 196.138.10.47 |
| Apr 2, 2025 22:24:24.516915083 CEST | 42030 | 23 | 192.168.2.13 | 109.137.220.217 |
| Apr 2, 2025 22:24:24.516918898 CEST | 42030 | 23 | 192.168.2.13 | 143.4.0.72 |
| Apr 2, 2025 22:24:24.516918898 CEST | 42030 | 23 | 192.168.2.13 | 182.230.197.164 |
| Apr 2, 2025 22:24:24.516942978 CEST | 42030 | 23 | 192.168.2.13 | 248.219.125.121 |
| Apr 2, 2025 22:24:24.516976118 CEST | 42030 | 23 | 192.168.2.13 | 178.104.82.212 |
| Apr 2, 2025 22:24:24.517035007 CEST | 42030 | 23 | 192.168.2.13 | 5.51.226.254 |
| Apr 2, 2025 22:24:24.517045021 CEST | 42030 | 23 | 192.168.2.13 | 165.82.14.146 |
| Apr 2, 2025 22:24:24.517065048 CEST | 42030 | 23 | 192.168.2.13 | 210.61.175.22 |
| Apr 2, 2025 22:24:24.517069101 CEST | 42030 | 23 | 192.168.2.13 | 167.167.167.168 |
| Apr 2, 2025 22:24:24.517072916 CEST | 42030 | 23 | 192.168.2.13 | 44.21.0.13 |
| Apr 2, 2025 22:24:24.517080069 CEST | 42030 | 23 | 192.168.2.13 | 249.29.163.251 |
| Apr 2, 2025 22:24:24.517080069 CEST | 42030 | 23 | 192.168.2.13 | 57.67.31.196 |
| Apr 2, 2025 22:24:24.517086029 CEST | 42030 | 23 | 192.168.2.13 | 220.198.254.21 |
| Apr 2, 2025 22:24:24.517086029 CEST | 42030 | 23 | 192.168.2.13 | 63.16.233.138 |
| Apr 2, 2025 22:24:24.517095089 CEST | 42030 | 23 | 192.168.2.13 | 24.181.109.112 |
| Apr 2, 2025 22:24:24.517115116 CEST | 42030 | 23 | 192.168.2.13 | 204.37.135.91 |
| Apr 2, 2025 22:24:24.517137051 CEST | 42030 | 23 | 192.168.2.13 | 123.186.87.113 |
| Apr 2, 2025 22:24:24.517141104 CEST | 42030 | 23 | 192.168.2.13 | 47.150.231.88 |
| Apr 2, 2025 22:24:24.517194986 CEST | 42030 | 23 | 192.168.2.13 | 104.45.164.55 |
| Apr 2, 2025 22:24:24.517195940 CEST | 42030 | 23 | 192.168.2.13 | 248.193.88.141 |
| Apr 2, 2025 22:24:24.517210960 CEST | 42030 | 23 | 192.168.2.13 | 92.163.232.206 |
| Apr 2, 2025 22:24:24.517240047 CEST | 42030 | 23 | 192.168.2.13 | 159.23.72.247 |
| Apr 2, 2025 22:24:24.517263889 CEST | 42030 | 23 | 192.168.2.13 | 91.73.211.232 |
| Apr 2, 2025 22:24:24.517271042 CEST | 42030 | 23 | 192.168.2.13 | 71.13.230.103 |
| Apr 2, 2025 22:24:24.517275095 CEST | 42030 | 23 | 192.168.2.13 | 187.12.132.94 |
| Apr 2, 2025 22:24:24.517283916 CEST | 42030 | 23 | 192.168.2.13 | 79.166.195.224 |
| Apr 2, 2025 22:24:24.517332077 CEST | 42030 | 23 | 192.168.2.13 | 13.208.36.79 |
| Apr 2, 2025 22:24:24.517334938 CEST | 42030 | 23 | 192.168.2.13 | 175.93.126.134 |
| Apr 2, 2025 22:24:24.517345905 CEST | 42030 | 23 | 192.168.2.13 | 181.46.167.154 |
| Apr 2, 2025 22:24:24.517359972 CEST | 42030 | 23 | 192.168.2.13 | 159.131.32.7 |
| Apr 2, 2025 22:24:24.517359972 CEST | 42030 | 23 | 192.168.2.13 | 41.29.25.209 |
| Apr 2, 2025 22:24:24.517427921 CEST | 42030 | 23 | 192.168.2.13 | 185.28.112.152 |
| Apr 2, 2025 22:24:24.517435074 CEST | 42030 | 23 | 192.168.2.13 | 97.18.251.177 |
| Apr 2, 2025 22:24:24.517453909 CEST | 42030 | 23 | 192.168.2.13 | 116.132.167.28 |
| Apr 2, 2025 22:24:24.517463923 CEST | 42030 | 23 | 192.168.2.13 | 141.49.34.44 |
| Apr 2, 2025 22:24:24.517474890 CEST | 42030 | 23 | 192.168.2.13 | 172.156.18.100 |
| Apr 2, 2025 22:24:24.517493963 CEST | 42030 | 23 | 192.168.2.13 | 208.87.9.44 |
| Apr 2, 2025 22:24:24.517519951 CEST | 42030 | 23 | 192.168.2.13 | 42.15.118.251 |
| Apr 2, 2025 22:24:24.517525911 CEST | 42030 | 23 | 192.168.2.13 | 41.174.93.32 |
| Apr 2, 2025 22:24:24.517532110 CEST | 42030 | 23 | 192.168.2.13 | 223.214.236.67 |
| Apr 2, 2025 22:24:24.517541885 CEST | 42030 | 23 | 192.168.2.13 | 114.189.85.40 |
| Apr 2, 2025 22:24:24.517549992 CEST | 42030 | 23 | 192.168.2.13 | 222.253.89.7 |
| Apr 2, 2025 22:24:24.517555952 CEST | 42030 | 23 | 192.168.2.13 | 249.68.170.92 |
| Apr 2, 2025 22:24:24.517563105 CEST | 42030 | 23 | 192.168.2.13 | 113.200.85.5 |
| Apr 2, 2025 22:24:24.517569065 CEST | 42030 | 23 | 192.168.2.13 | 71.24.101.190 |
| Apr 2, 2025 22:24:24.517615080 CEST | 42030 | 23 | 192.168.2.13 | 153.75.181.56 |
| Apr 2, 2025 22:24:24.517615080 CEST | 42030 | 23 | 192.168.2.13 | 42.58.125.121 |
| Apr 2, 2025 22:24:24.517621994 CEST | 42030 | 23 | 192.168.2.13 | 175.165.195.99 |
| Apr 2, 2025 22:24:24.517625093 CEST | 42030 | 23 | 192.168.2.13 | 16.243.109.221 |
| Apr 2, 2025 22:24:24.517647982 CEST | 42030 | 23 | 192.168.2.13 | 58.247.203.226 |
| Apr 2, 2025 22:24:24.517673016 CEST | 42030 | 23 | 192.168.2.13 | 172.60.155.46 |
| Apr 2, 2025 22:24:24.517673016 CEST | 42030 | 23 | 192.168.2.13 | 89.189.176.46 |
| Apr 2, 2025 22:24:24.517719030 CEST | 42030 | 23 | 192.168.2.13 | 164.4.146.220 |
| Apr 2, 2025 22:24:24.517733097 CEST | 42030 | 23 | 192.168.2.13 | 193.51.254.148 |
| Apr 2, 2025 22:24:24.517733097 CEST | 42030 | 23 | 192.168.2.13 | 86.125.177.22 |
| Apr 2, 2025 22:24:24.517733097 CEST | 42030 | 23 | 192.168.2.13 | 179.228.199.52 |
| Apr 2, 2025 22:24:24.517748117 CEST | 42030 | 23 | 192.168.2.13 | 222.55.102.165 |
| Apr 2, 2025 22:24:24.517760992 CEST | 42030 | 23 | 192.168.2.13 | 223.76.14.186 |
| Apr 2, 2025 22:24:24.517762899 CEST | 42030 | 23 | 192.168.2.13 | 112.115.194.12 |
| Apr 2, 2025 22:24:24.517770052 CEST | 42030 | 23 | 192.168.2.13 | 97.62.209.101 |
| Apr 2, 2025 22:24:24.517775059 CEST | 42030 | 23 | 192.168.2.13 | 72.229.209.226 |
| Apr 2, 2025 22:24:24.517775059 CEST | 42030 | 23 | 192.168.2.13 | 187.49.191.145 |
| Apr 2, 2025 22:24:24.517777920 CEST | 42030 | 23 | 192.168.2.13 | 150.108.253.187 |
| Apr 2, 2025 22:24:24.517802000 CEST | 42030 | 23 | 192.168.2.13 | 152.245.41.117 |
| Apr 2, 2025 22:24:24.517812014 CEST | 42030 | 23 | 192.168.2.13 | 106.73.18.109 |
| Apr 2, 2025 22:24:24.517816067 CEST | 42030 | 23 | 192.168.2.13 | 83.176.241.214 |
| Apr 2, 2025 22:24:24.517867088 CEST | 42030 | 23 | 192.168.2.13 | 160.181.75.178 |
| Apr 2, 2025 22:24:24.517867088 CEST | 42030 | 23 | 192.168.2.13 | 249.235.230.125 |
| Apr 2, 2025 22:24:24.517867088 CEST | 42030 | 23 | 192.168.2.13 | 247.214.74.59 |
| Apr 2, 2025 22:24:24.517868042 CEST | 42030 | 23 | 192.168.2.13 | 9.34.59.108 |
| Apr 2, 2025 22:24:24.517940998 CEST | 42030 | 23 | 192.168.2.13 | 100.59.85.209 |
| Apr 2, 2025 22:24:24.519423008 CEST | 42030 | 23 | 192.168.2.13 | 13.26.40.29 |
| Apr 2, 2025 22:24:24.519428968 CEST | 42030 | 23 | 192.168.2.13 | 85.239.102.98 |
| Apr 2, 2025 22:24:24.519443989 CEST | 42030 | 23 | 192.168.2.13 | 187.33.212.99 |
| Apr 2, 2025 22:24:24.519478083 CEST | 42030 | 23 | 192.168.2.13 | 213.218.209.36 |
| Apr 2, 2025 22:24:24.519498110 CEST | 42030 | 23 | 192.168.2.13 | 197.93.232.222 |
| Apr 2, 2025 22:24:24.519500017 CEST | 42030 | 23 | 192.168.2.13 | 99.195.58.224 |
| Apr 2, 2025 22:24:24.519500971 CEST | 42030 | 23 | 192.168.2.13 | 211.182.119.68 |
| Apr 2, 2025 22:24:24.519500971 CEST | 42030 | 23 | 192.168.2.13 | 192.138.242.154 |
| Apr 2, 2025 22:24:24.519504070 CEST | 42030 | 23 | 192.168.2.13 | 12.175.207.62 |
| Apr 2, 2025 22:24:24.519505024 CEST | 42030 | 23 | 192.168.2.13 | 19.5.27.105 |
| Apr 2, 2025 22:24:24.519506931 CEST | 42030 | 23 | 192.168.2.13 | 121.135.21.103 |
| Apr 2, 2025 22:24:24.519529104 CEST | 42030 | 23 | 192.168.2.13 | 174.76.175.233 |
| Apr 2, 2025 22:24:24.519530058 CEST | 42030 | 23 | 192.168.2.13 | 254.233.232.240 |
| Apr 2, 2025 22:24:24.519567013 CEST | 42030 | 23 | 192.168.2.13 | 40.151.101.148 |
| Apr 2, 2025 22:24:24.519577980 CEST | 42030 | 23 | 192.168.2.13 | 222.148.244.179 |
| Apr 2, 2025 22:24:24.519577980 CEST | 42030 | 23 | 192.168.2.13 | 192.83.184.219 |
| Apr 2, 2025 22:24:24.519577980 CEST | 42030 | 23 | 192.168.2.13 | 85.220.230.68 |
| Apr 2, 2025 22:24:24.519582987 CEST | 42030 | 23 | 192.168.2.13 | 111.60.66.239 |
| Apr 2, 2025 22:24:24.519582987 CEST | 42030 | 23 | 192.168.2.13 | 180.117.61.248 |
| Apr 2, 2025 22:24:24.519619942 CEST | 42030 | 23 | 192.168.2.13 | 8.155.63.182 |
| Apr 2, 2025 22:24:24.519622087 CEST | 42030 | 23 | 192.168.2.13 | 102.172.209.25 |
| Apr 2, 2025 22:24:24.519622087 CEST | 42030 | 23 | 192.168.2.13 | 69.190.220.200 |
| Apr 2, 2025 22:24:24.519627094 CEST | 42030 | 23 | 192.168.2.13 | 211.62.217.24 |
| Apr 2, 2025 22:24:24.519627094 CEST | 42030 | 23 | 192.168.2.13 | 117.234.162.255 |
| Apr 2, 2025 22:24:24.519633055 CEST | 42030 | 23 | 192.168.2.13 | 116.239.121.129 |
| Apr 2, 2025 22:24:24.519634962 CEST | 42030 | 23 | 192.168.2.13 | 83.37.26.41 |
| Apr 2, 2025 22:24:24.519637108 CEST | 42030 | 23 | 192.168.2.13 | 67.188.100.213 |
| Apr 2, 2025 22:24:24.519637108 CEST | 42030 | 23 | 192.168.2.13 | 220.95.23.25 |
| Apr 2, 2025 22:24:24.519695044 CEST | 42030 | 23 | 192.168.2.13 | 155.193.156.43 |
| Apr 2, 2025 22:24:24.519695044 CEST | 42030 | 23 | 192.168.2.13 | 106.152.236.194 |
| Apr 2, 2025 22:24:24.519696951 CEST | 42030 | 23 | 192.168.2.13 | 12.53.0.241 |
| Apr 2, 2025 22:24:24.519696951 CEST | 42030 | 23 | 192.168.2.13 | 219.138.124.41 |
| Apr 2, 2025 22:24:24.519709110 CEST | 42030 | 23 | 192.168.2.13 | 155.89.78.12 |
| Apr 2, 2025 22:24:24.519709110 CEST | 42030 | 23 | 192.168.2.13 | 32.124.107.121 |
| Apr 2, 2025 22:24:24.519715071 CEST | 42030 | 23 | 192.168.2.13 | 101.47.181.207 |
| Apr 2, 2025 22:24:24.519715071 CEST | 42030 | 23 | 192.168.2.13 | 113.244.94.110 |
| Apr 2, 2025 22:24:24.519717932 CEST | 42030 | 23 | 192.168.2.13 | 222.71.45.132 |
| Apr 2, 2025 22:24:24.519723892 CEST | 42030 | 23 | 192.168.2.13 | 242.141.230.173 |
| Apr 2, 2025 22:24:24.519829988 CEST | 42030 | 23 | 192.168.2.13 | 251.144.43.121 |
| Apr 2, 2025 22:24:24.519844055 CEST | 42030 | 23 | 192.168.2.13 | 93.224.178.111 |
| Apr 2, 2025 22:24:24.519861937 CEST | 42030 | 23 | 192.168.2.13 | 179.59.146.113 |
| Apr 2, 2025 22:24:24.519866943 CEST | 42030 | 23 | 192.168.2.13 | 253.87.186.79 |
| Apr 2, 2025 22:24:24.519866943 CEST | 42030 | 23 | 192.168.2.13 | 120.52.206.108 |
| Apr 2, 2025 22:24:24.519898891 CEST | 42030 | 23 | 192.168.2.13 | 141.108.113.41 |
| Apr 2, 2025 22:24:24.519901037 CEST | 42030 | 23 | 192.168.2.13 | 152.189.207.148 |
| Apr 2, 2025 22:24:24.732568979 CEST | 7887 | 52644 | 213.209.129.92 | 192.168.2.13 |
| Apr 2, 2025 22:24:32.755558014 CEST | 57216 | 443 | 192.168.2.13 | 54.247.62.1 |
| Apr 2, 2025 22:24:56.452831030 CEST | 57216 | 443 | 192.168.2.13 | 54.247.62.1 |
| Apr 2, 2025 22:24:56.630472898 CEST | 443 | 57216 | 54.247.62.1 | 192.168.2.13 |
| Timestamp | Source IP | Dest IP | Checksum | Code | Type |
|---|---|---|---|---|---|
| Apr 2, 2025 22:24:52.938177109 CEST | 192.168.2.13 | 192.168.2.1 | 8279 | (Port unreachable) | Destination Unreachable |
| Apr 2, 2025 22:26:12.961169004 CEST | 192.168.2.13 | 192.168.2.1 | 8279 | (Port unreachable) | Destination Unreachable |
System Behavior
| Start time (UTC): | 20:24:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.mpsl.elf |
| Arguments: | /tmp/xd.mpsl.elf |
| File size: | 5773336 bytes |
| MD5 hash: | 0d6f61f82cf2f781c6eb0661071d42d9 |
| Start time (UTC): | 20:24:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.mpsl.elf |
| Arguments: | - |
| File size: | 5773336 bytes |
| MD5 hash: | 0d6f61f82cf2f781c6eb0661071d42d9 |
| Start time (UTC): | 20:24:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.mpsl.elf |
| Arguments: | - |
| File size: | 5773336 bytes |
| MD5 hash: | 0d6f61f82cf2f781c6eb0661071d42d9 |
| Start time (UTC): | 20:24:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.mpsl.elf |
| Arguments: | - |
| File size: | 5773336 bytes |
| MD5 hash: | 0d6f61f82cf2f781c6eb0661071d42d9 |
| Start time (UTC): | 20:24:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.mpsl.elf |
| Arguments: | - |
| File size: | 5773336 bytes |
| MD5 hash: | 0d6f61f82cf2f781c6eb0661071d42d9 |
| Start time (UTC): | 20:24:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.mpsl.elf |
| Arguments: | - |
| File size: | 5773336 bytes |
| MD5 hash: | 0d6f61f82cf2f781c6eb0661071d42d9 |
| Start time (UTC): | 20:24:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /tmp/xd.mpsl.elf |
| Arguments: | - |
| File size: | 5773336 bytes |
| MD5 hash: | 0d6f61f82cf2f781c6eb0661071d42d9 |
| Start time (UTC): | 20:24:35 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:35 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/journalctl |
| Arguments: | /usr/bin/journalctl --smart-relinquish-var |
| File size: | 80120 bytes |
| MD5 hash: | bf3a987344f3bacafc44efd882abda8b |
| Start time (UTC): | 20:24:35 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:35 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:35 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:35 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:35 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/pulseaudio |
| Arguments: | /usr/bin/pulseaudio --daemonize=no --log-target=journal |
| File size: | 100832 bytes |
| MD5 hash: | 0c3b4c789d8ffb12b25507f27e14c186 |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/sbin/gdm3 |
| Arguments: | - |
| File size: | 453296 bytes |
| MD5 hash: | 2492e2d8d34f9377e3e530a61a15674f |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /etc/gdm3/PrimeOff/Default |
| Arguments: | /etc/gdm3/PrimeOff/Default |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/sbin/gdm3 |
| Arguments: | - |
| File size: | 453296 bytes |
| MD5 hash: | 2492e2d8d34f9377e3e530a61a15674f |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /etc/gdm3/PrimeOff/Default |
| Arguments: | /etc/gdm3/PrimeOff/Default |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/sbin/gdm3 |
| Arguments: | - |
| File size: | 453296 bytes |
| MD5 hash: | 2492e2d8d34f9377e3e530a61a15674f |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /etc/gdm3/PrimeOff/Default |
| Arguments: | /etc/gdm3/PrimeOff/Default |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:49 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:50 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:50 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf" |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/sh |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:51 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/grep |
| Arguments: | grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf |
| File size: | 199136 bytes |
| MD5 hash: | 1e6ebb9dd094f774478f72727bdba0f5 |
| Start time (UTC): | 20:24:52 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:52 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/share/gdm/generate-config |
| Arguments: | /usr/share/gdm/generate-config |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:52 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/share/gdm/generate-config |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:52 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/pkill |
| Arguments: | pkill --signal HUP --uid gdm dconf-service |
| File size: | 30968 bytes |
| MD5 hash: | fa96a75a08109d8842e4865b2907d51f |
| Start time (UTC): | 20:24:53 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:24:53 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/gdm3/gdm-wait-for-drm |
| Arguments: | /usr/lib/gdm3/gdm-wait-for-drm |
| File size: | 14640 bytes |
| MD5 hash: | 82043ba752c6930b4e6aaea2f7747545 |
| Start time (UTC): | 20:24:54 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/libexec/gvfsd-fuse |
| Arguments: | - |
| File size: | 47632 bytes |
| MD5 hash: | d18fbf1cbf8eb57b17fac48b7b4be933 |
| Start time (UTC): | 20:24:54 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/fusermount |
| Arguments: | fusermount -u -q -z -- /run/user/1000/gvfs |
| File size: | 39144 bytes |
| MD5 hash: | 576a1b135c82bdcbc97a91acea900566 |
| Start time (UTC): | 20:24:55 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/dash |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:55 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/rm |
| Arguments: | rm -f /tmp/tmp.06jbdO8dPm /tmp/tmp.0Tm9n5dnO5 /tmp/tmp.2hKiLMWhVp |
| File size: | 72056 bytes |
| MD5 hash: | aa2b5496fdbfd88e38791ab81f90b95b |
| Start time (UTC): | 20:24:55 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/dash |
| Arguments: | - |
| File size: | 129816 bytes |
| MD5 hash: | 1e6b1c887c59a315edb7eb9a315fc84c |
| Start time (UTC): | 20:24:55 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/rm |
| Arguments: | rm -f /tmp/tmp.06jbdO8dPm /tmp/tmp.0Tm9n5dnO5 /tmp/tmp.2hKiLMWhVp |
| File size: | 72056 bytes |
| MD5 hash: | aa2b5496fdbfd88e38791ab81f90b95b |
| Start time (UTC): | 20:25:03 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:03 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/sbin/gdm3 |
| Arguments: | /usr/sbin/gdm3 |
| File size: | 453296 bytes |
| MD5 hash: | 2492e2d8d34f9377e3e530a61a15674f |
| Start time (UTC): | 20:25:03 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:03 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:03 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:03 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:03 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:23 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:24 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:24 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:24 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:25 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:26 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:27 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:28 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:28 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:28 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:28 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:28 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:28 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:28 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:28 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:29 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | /usr/bin/gpu-manager --log /var/log/gpu-manager.log |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:30 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/bin/gpu-manager |
| Arguments: | - |
| File size: | 76616 bytes |
| MD5 hash: | 8fae9dd5dd67e1f33d873089c2fd8761 |
| Start time (UTC): | 20:25:31 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:32 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
| Start time (UTC): | 20:25:32 |
| Start date (UTC): | 02/04/2025 |
| Path: | /bin/plymouth |
| Arguments: | /bin/plymouth quit |
| File size: | 51352 bytes |
| MD5 hash: | 87003efd8dad470042f5e75360a8f49f |
| Start time (UTC): | 20:26:24 |
| Start date (UTC): | 02/04/2025 |
| Path: | /usr/lib/systemd/systemd (deleted) |
| Arguments: | - |
| File size: | 1620224 bytes |
| MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
